CVE-2025-53302

Vulnerability

A missing authorization vulnerability exists in the Anton Shevchuk Constructor theme, affecting versions up to and including 1.6.5. This flaw allows unauthorized users to access functionality that should be protected by Access Control Lists (ACLs) [1].

Exploitation

An attacker can exploit this vulnerability by leveraging a missing authorization check within a function. This allows an unprivileged user to execute actions typically reserved for higher-privileged users, potentially without needing specific authentication tokens or nonce checks [1].

Impact

Successful exploitation of this vulnerability grants an attacker the ability to execute higher-privileged actions. This could lead to unauthorized modifications or access to sensitive data, depending on the specific functionality that is improperly constrained by ACLs [1].

Mitigation

The recommended mitigation is to update the Constructor theme to a version later than 1.6.5. If an immediate update is not possible, users should seek assistance from their hosting provider or web developer. The specific fixed version and release date are not detailed in the available references [1].