This vulnerability arises from privilege defined with unsafe actions in the Drupal Custom Formatters module, allowing an attacker to increase privileges beyond their intended level. The issue permits escalation of permissions, potentially granting administrative capabilities to an unauthorized user. The description does not reference remote code execution though the advisory title mentions it; the effective impact is limited to privilege escalation as specified.

The Drupal Custom Formatters module is affected, covering all released versions from 0.0.0 through 4.2.1. Any site using the module within this version range is vulnerable.

No CVSS score is available, and the EPSS is not reported, making precise risk calculation difficult. The vulnerability is not listed in the CISA KEV catalog, suggesting it is not publicly exploited at large scale yet. Based on the described flaw and common exploitation patterns for unsafe actions, the attack vector is likely application-level: an attacker with some authenticated access or the ability to create or edit formatted content can trigger the privilege escalation. The impact is mainly potential unauthorized elevation to higher user roles, which can lead to full site takeover if the elevated privileges grant site-wide control.