CVE-2026-65479 is a broken access control vulnerability (CWE-862) affecting MVP Themes Reviewer versions up to 3.14.2. The flaw involves missing authorization checks that could allow a subscriber-level user to perform actions beyond their intended permissions. The CVSS 3.1 base score is 5.4 (medium), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and limited availability impact. No patch or official remediation level has been published as of the vulnerability disclosure date.

Exploitation of this vulnerability could allow an attacker with subscriber-level privileges to perform unauthorized actions, potentially modifying data or disrupting service availability. There is no confidentiality impact reported. The vulnerability does not require user interaction and can be exploited remotely over the network with low complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber privileges where possible and monitor for unusual activity related to authorization bypass. Avoid granting unnecessary permissions to subscriber accounts.