A critical authorization bypass vulnerability in the themeplugs Authorsy plugin allows unauthenticated attackers to access restricted information without proper verification.

This vulnerability is an authorization bypass (CWE-639) occurring via user-controlled keys. It allows an unauthenticated attacker to manipulate parameters to access data they are not authorized to view.

The ability for an unauthenticated user to bypass access controls directly threatens the confidentiality of user or site data managed by the Authorsy plugin. Given the CVSS score of 7.5, this high-severity flaw could lead to unauthorized data exposure, potentially resulting in significant privacy violations or the loss of proprietary information.

Immediate Action: Since a specific patch version is not currently identified, users should disable or remove the Authorsy plugin until the vendor releases a security update that addresses the authorization flaw.

Proactive Monitoring: Security teams should review web server access logs for anomalous requests targeting plugin-specific endpoints or patterns indicative of IDOR exploitation.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to filter and block suspicious requests that exhibit patterns of unauthorized parameter manipulation or unexpected object access attempts.

Public Exploit Available: Unknown.

The vulnerability presents a clear risk to data confidentiality due to the lack of required authentication. Organizations utilizing the Authorsy plugin must prioritize the mitigation of this risk by restricting access or removing the plugin until a verified fix is provided by themeplugs. Continuous monitoring of the application environment is essential until the software is updated to a patched version.