This vulnerability affects JPress versions 1.0.0 through 1.0.3 in the UCenter Article Submission Endpoint component. An attacker can manipulate the id/userId parameters in the /ucenter/article/doWriteSave function to bypass authorization controls. The vulnerability is remotely exploitable without user interaction and requires low privileges. The CVSS 4.0 base score is 5.3 (medium), reflecting the potential for limited impact due to improper authorization. The vendor has not yet issued a fix or official remediation guidance.

Successful exploitation could allow an attacker with limited privileges to perform unauthorized actions related to article submission in JPress, potentially modifying or submitting content without proper authorization. The impact is limited to the scope of the affected function and does not include privilege escalation or remote code execution based on the available data. No active exploits have been reported in the wild.

No official patch or remediation is currently available from the vendor. Users should monitor the vendor's advisory channels for updates. Until a fix is released, restricting access to the affected endpoint and implementing additional access controls or input validation may reduce risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.