Missing Authorization vulnerability in averta Shortcodes and extra features for Phlox theme auxin-elements allows Exploiting Incorrectly Configured… (CVE-2025-69016)

CVE-2025-69016 describes a missing authorization vulnerability in the averta Shortcodes and extra features for the Phlox theme auxin-elements. This vulnerability arises from incorrectly configured access control security levels, potentially allowing unauthorized actions. It affects all versions up to and including 2.17.12 of the affected software. The CVSS 3.1 base score is 4.3, indicating a medium severity impact primarily due to limited integrity impact without confidentiality or availability impact.

The vulnerability allows an attacker with some level of privileges (PR:L) to exploit missing authorization controls, potentially leading to unauthorized modification of data (integrity impact). There is no impact on confidentiality or availability. The attack vector is network-based and does not require user interaction.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, review and correct access control configurations for the affected components to ensure proper authorization enforcement.