This vulnerability, identified as CWE-862 (Missing Authorization), affects Visual Composer Website Builder versions up to 45.15.0. It allows contributor-level users to bypass intended access controls, potentially enabling unauthorized modification of content or settings. The CVSS 3.1 base score is 5.0 (medium), reflecting network attack vector, low attack complexity, required privileges at the contributor level, no user interaction, and a scope change with integrity impact only. No known exploits are reported, and no vendor advisory or patch information is available at this time.

An attacker with contributor-level privileges can exploit this vulnerability to perform unauthorized actions that affect the integrity of the website content or configuration. There is no impact on confidentiality or availability. The scope of the vulnerability is changed, meaning the impact extends beyond the initially intended security boundary.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor privileges to trusted users only and monitor for suspicious activity related to unauthorized changes.