This vulnerability (CVE-2026-65524) is classified as CWE-862 (Missing Authorization) affecting Avada Custom Branding plugin versions up to 1.2. It allows users with contributor privileges to bypass access controls and perform unauthorized actions. The CVSS 3.1 base score is 4.3, reflecting network attack vector, low attack complexity, required privileges at the contributor level, no user interaction, unchanged scope, limited confidentiality impact, and no impact on integrity or availability. No official patch or remediation information is currently available, and no known exploits are reported in the wild.

An attacker with contributor-level access can exploit this vulnerability to gain unauthorized access to functionality or data within the Avada Custom Branding plugin, potentially leading to limited confidentiality breaches. There is no impact on data integrity or availability. The vulnerability requires network access and contributor privileges but no user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and monitor for unusual activity related to the Avada Custom Branding plugin.