The vulnerability in BcAddonMigrator occurs because it includes the "config.php" file from addons during conversion from baserCMS4 to baserCMS5 styles, executing PHP code contained therein. This inclusion of functionality from an untrusted control sphere enables an administrative user to perform unauthorized file read or deletion operations on the system.

An administrative user can exploit this vulnerability to read or delete arbitrary files on the affected system. This can lead to confidentiality breaches, data loss, or disruption of service. The CVSS 3.0 score is 7.2 (high), reflecting network attack vector, low attack complexity, required high privileges, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrative users should exercise caution when converting addons and avoid using untrusted addons. Monitor vendor channels for updates and apply patches promptly once released.