This vulnerability in UX-themes Flatsome (<= 3.20.5) is classified as CWE-862 Missing Authorization. It allows users with contributor privileges to bypass intended access controls, potentially leading to unauthorized access to sensitive functionality or data. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) indicates that the attack can be performed remotely over the network with low complexity, requires privileges of a contributor, does not require user interaction, and impacts confidentiality with no impact on integrity or availability. There is no vendor advisory or patch available at this time, and no known exploits in the wild have been reported.

An attacker with contributor-level access can exploit this missing authorization vulnerability to gain unauthorized access to sensitive information, leading to a high confidentiality impact. There is no impact on integrity or availability. The vulnerability could allow data exposure beyond intended permissions within the affected Flatsome versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and monitor for suspicious activity related to unauthorized access attempts.