Unauthenticated remote brute-force of the Dbit N300 T1 Pro wireless router (firmware V1.0.0) is trivially achievable because the /api/login endpoint imposes no rate limiting, account lockout, or throttling of any kind. Any attacker with network access to the management interface can attempt unlimited password guesses until admin credentials are found. A publicly available proof-of-concept exploit exists on GitHub; however, EPSS at 0.29% (21st percentile) and absence from CISA KEV suggest exploitation remains limited in practice, likely constrained by the product's small market footprint.
PodcastGenerator 3.2.9 contains a blind server-side request forgery vulnerability that allows attackers to inject XML in the episode upload form. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Spip 4.1.10 contains a file upload vulnerability that allows attackers to upload malicious SVG files with embedded external links. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Stored cross-site scripting (XSS) in ThemeNectar Salient Shortcodes WordPress plugin through version 1.5.4 allows authenticated users with low privileges to inject malicious scripts that execute in the context of higher-privileged administrators or other site visitors. The vulnerability requires user interaction (UI:R in CVSS vector) and affects the shortcode generation functionality, enabling persistence of malicious payloads in page content. EPSS score of 0.06% indicates low real-world exploitation probability despite the moderate CVSS 6.5 rating.
Stored cross-site scripting (XSS) in VK Google Job Posting Manager WordPress plugin versions up to 1.2.22 allows authenticated users with low privileges to inject malicious scripts that execute in the context of other users' browsers, potentially compromising site administrators. The vulnerability requires user interaction (clicking a link or viewing a malicious page) to trigger payload execution and affects the plugin's web page generation functionality. EPSS probability of exploitation is notably low at 0.04%, suggesting this is primarily a theoretical risk without documented active exploitation.
Stored cross-site scripting (XSS) in Premio Stars Testimonials WordPress plugin versions 3.3.4 and below allows authenticated users to inject malicious scripts that execute in the context of other users' browsers, potentially compromising site administrators or visitors. The vulnerability requires user interaction (UI:R) and authenticated access (PR:L), limiting immediate risk, but the stored nature means injected payloads persist and affect multiple users. No public exploit code or active KEV status is documented, though the 6.5 CVSS score reflects moderate severity when considering cross-site impact.
Authorization bypass in Essential Real Estate WordPress plugin versions through 5.2.9 allows authenticated users to access sensitive real estate data they should not have permission to view through user-controlled key manipulation. The vulnerability exploits incorrectly configured access control at the application level, enabling privilege escalation from a standard user account to view confidential information such as property details or pricing. No public exploit code has been identified, and the EPSS score of 0.04% indicates low exploitation probability despite the CVSS 6.5 severity rating.
Keycloak's admin API endpoints for authorization resource management contain an IDOR vulnerability allowing authenticated administrators with fine-grained permissions for one client to delete or modify resources belonging to other clients within the same realm. The flaw exists in ResourceSetService and PermissionTicketService where authorization checks validate the resourceServer (client) ID from the API request, but backend database operations use only the resourceId, creating a permission bypass. Affected administrators can exploit this with standard HTTP requests to cross-client resource boundaries; no public exploit code identified at time of analysis.
DOM-based cross-site scripting in the Document Library Lite WordPress plugin (versions <=1.1.7) allows authenticated attackers with high privileges to execute arbitrary JavaScript in the browser of an administrator who visits a crafted page. This could lead to account compromise or malicious actions within the WordPress admin.
Server-side request forgery in LMPixels Kerge WordPress theme 4.1.3 and earlier allows unauthenticated attackers to coerce the theme into making server-side requests to arbitrary destinations. Successful exploitation can lead to limited information disclosure or interaction with internal services. No active exploitation or public exploit code is currently known, and the EPSS probability is very low (0.05%), suggesting a low immediate risk.
Authenticated users with limited privileges can modify plugin settings and access functionality they should not have access to via missing authorization checks in Buttoner for Elementor through version 1.0.6. The vulnerability requires valid WordPress user credentials but no administrative role, allowing privilege escalation within the plugin's configuration interface. EPSS score of 0.05% indicates low exploitation probability despite network accessibility.
Broken access controls in Ultimate Auction plugin for WordPress up to version 4.3.3 allow low-privileged attackers to modify or disrupt auction operations. The missing authorization checks (CWE-862) enable unauthorized changes without user interaction, impacting integrity and availability but not confidentiality. No active exploitation or public exploit code has been reported; EPSS indicates a low exploitation probability.
Missing authorization in NinjaTeam FileBird Pro WordPress plugin versions up to 6.5.1 allows authenticated users to access and modify files they should not have permission to view or edit due to incorrectly configured access control security levels. The vulnerability requires valid user credentials but can lead to disclosure and modification of sensitive files within the plugin's file management interface. EPSS exploitation probability is low at 0.04%, and no public exploit code has been identified at the time of analysis.
Cross-site request forgery in the Meks Quick Plugin Disabler WordPress plugin (≤1.0) allows an attacker to trick a logged-in administrator into disabling plugins, leading to potential service disruption. No active exploitation or public exploit code is known; EPSS probability is 0.03%.
Cross-Site Request Forgery in the Semrush Content Toolkit WordPress plugin allows attackers to trick authenticated users into performing unauthorized actions. All versions up to 1.1.32 are vulnerable. No active exploitation or public exploit code has been reported, and EPSS score indicates very low likelihood of widespread exploitation.
Broken access control in ThemeFusion Avada WordPress theme through version 7.13.2 allows authenticated attackers with low privileges to access functionality improperly constrained by access control lists, potentially achieving full site compromise. With CVSS 8.8 (High) due to network-based access requiring only low-privilege authentication, attackers can achieve high confidentiality, integrity, and availability impact. EPSS probability remains low at 0.06% (18th percentile), and no public exploit identified at time of analysis, suggesting limited immediate exploitation risk despite the critical CVSS rating.
Information disclosure in wowpress.host Fix Media Library up to version 2.0 allows unauthenticated attackers to retrieve sensitive data embedded in sent data. The vulnerability, disclosed by Patchstack, has a CVSS 5.3 (medium) and a low EPSS exploitation probability (0.05%), with no known public exploits at this time.
Insecure direct object reference in Barn2 Document Library Lite plugin for WordPress allows unauthenticated remote attackers to read arbitrary documents by manipulating a user-controlled key parameter. Affected versions include all releases up to and including 1.1.7, with low confidentiality impact and no integrity or availability loss.
Remote unauthenticated attackers can exploit missing authorization checks in the Homey Core plugin (versions ≤ 2.4.3) to degrade service availability. The vulnerability stems from a missing authorization flaw (CWE-862) that permits unauthorized interaction with vulnerable endpoints. No public exploit code has been identified and active exploitation is not confirmed at the time of analysis.
Missing authorization in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin versions up to 4.0.7 allows unauthenticated attackers to modify cookie consent settings, potentially undermining the site’s compliance posture. No active exploitation or public proof-of-concept has been identified, and the EPSS score (0.05%) indicates very low exploitation probability.
Missing authorization in Sendinblue for WooCommerce plugin versions up to 4.0.49 allows unauthenticated attackers to modify newsletter subscription settings with low integrity impact. The vulnerability (CVE-2025-66128) has a CVSS 5.3 but a very low EPSS exploitation probability (0.05%) and no known active exploitation or public exploit code.
Missing authorization in the SiteGround Security plugin for WordPress (≤1.5.8) allows unauthenticated remote attackers to trigger availability disruptions by exploiting incorrectly configured access controls. The vulnerability has a CVSS 5.3 (Medium) but EPSS scores only 0.05%, indicating minimal predicted exploitation; no active attacks or public exploit code have been observed.
Unauthenticated information disclosure in the CatFolders WordPress plugin up to version 2.5.3 allows remote attackers to access restricted data via a missing authorization check. No public exploit is known, and EPSS indicates a low exploitation probability (0.05%).
Unauthenticated modification of plugin data in OnPay.io for WooCommerce through version 1.0.47 allows remote attackers to alter plugin settings via missing authorization checks. The WordPress plugin lacks proper capability verification, enabling attackers with no privileges to perform actions that should require authentication. Exploitation probability is negligible per EPSS, and no active attacks or public exploit code have been identified.
Sensitive information disclosure in WordPress Ultimate Auction plugin up to version 4.3.3 allows unauthenticated remote attackers to retrieve embedded sensitive data from the application's responses. No authentication is required, making exploitation simple with only network access needed. Current threat intelligence indicates a very low risk of exploitation, with no active attacks observed.
Denial of service in WordPress Protect WP Admin plugin <=4.1 allows unauthenticated remote attackers to degrade availability. A missing authorization check enables exploitation of incorrectly configured access control security levels, causing a low-impact loss of availability without affecting confidentiality or integrity. The vulnerability has a low EPSS score (0.05%) and no known public exploit or active exploitation.
Unauthenticated access to a sensitive function in the Stylish Price List WordPress plugin through version 7.2.2 allows remote attackers to degrade service availability. The missing authorization check can be leveraged to perform actions that impact the plugin's availability without requiring login credentials. No active exploitation or public exploit code has been identified.
Unauthenticated modification of plugin data affects Feeds for YouTube plugin for WordPress through version 2.4.0. The vulnerability stems from a missing authorization check, allowing remote attackers to alter settings without authentication. Despite a CVSS base score of 5.3, only low integrity impact is possible, and no active exploitation or public proof-of-concept has been identified at the time of analysis.
Broken access control in Yaad Sarig Payment Gateway for WooCommerce (versions ≤2.2.11) allows unauthenticated remote attackers to bypass authorization checks and gain unauthorized access to payment gateway functions. With CVSS 9.1 (Critical) scoring reflecting network-accessible exploitation requiring no privileges or user interaction, attackers can read or modify sensitive payment data. EPSS score of 0.04% (14th percentile) suggests low observed exploitation probability despite severity. No public exploit identified at time of analysis, though the authentication bypass tag indicates potential for unauthorized transaction manipulation or data exposure in WordPress e-commerce environments.
Unauthenticated remote attackers can bypass access controls in ZEEN101 Leaky Paywall WordPress plugin versions up to 4.22.6, gaining unauthorized access to restricted content through incorrectly configured security levels. The vulnerability requires no user interaction and can be exploited over the network, though it is limited to information disclosure (CVSS 5.3, EPSS 0.04%). No public exploit code or active exploitation has been identified at time of analysis.
Missing authorization in WP Compress for MainWP plugin versions up to 6.50.17 allows unauthenticated remote attackers to modify plugin settings due to incorrectly configured access control, affecting integrity of compressed content and plugin configuration without requiring authentication or user interaction.
Unauthenticated remote attackers can access sensitive sitemap data in Google XML Sitemaps WordPress plugin versions through 4.1.22 due to missing authorization checks on sitemap endpoints. The vulnerability allows unauthorized information disclosure of site structure and indexed pages without requiring authentication or user interaction. While the CVSS score is moderate (5.3), real-world exploitation probability is very low (EPSS 0.04th percentile), suggesting this is primarily an information disclosure risk rather than an active threat.
Authorization bypass in FAPI Member WordPress plugin through version 2.2.29 allows unauthenticated remote attackers to access or modify resources via insecure direct object references (IDOR) exploiting misconfigured access control security levels. The vulnerability requires no authentication, low attack complexity, and results in confidentiality and integrity impact without availability compromise. EPSS score of 0.04% indicates minimal real-world exploitation probability despite the moderate CVSS score.
Missing authorization in g5theme Essential Real Estate WordPress plugin version 5.2.9 and earlier allows authenticated users to access or modify restricted resources by exploiting inadequately configured access controls. An attacker with low-privilege WordPress account credentials can leverage the broken access control to view sensitive information and make unauthorized modifications without requiring administrative approval. No public exploit code is currently identified, though the vulnerability is documented in the Patchstack security database.
Information disclosure in the TI WooCommerce Wishlist WordPress plugin (≤2.10.0) allows unauthenticated attackers to read any user's wishlist data due to missing authorization checks. The vulnerability has a low CVSS base score of 5.3 and an extremely low EPSS exploitation probability (0.02%), indicating minimal real-world risk. No public exploit or active exploitation has been reported.
Denial-of-service vulnerability in Strategy11’s Business Directory Plugin for WordPress (≤ 6.4.19) allows authenticated high-privileged attackers to disrupt site availability. The flaw stems from missing authorization checks, permitting an admin-level user to trigger an action with high availability impact. No public exploit is known, and EPSS (0.06%) indicates low exploitation probability despite the network-based attack vector.
WCFM Marketplace plugin through version 3.7.1 fails to properly enforce authorization controls, allowing authenticated users with limited privileges to cause denial of service or access functionality they should not have. The vulnerability affects the WordPress plugin across all installations through the specified version, exploiting incorrectly configured access control security levels via network-accessible endpoints. With an EPSS score of 0.05% and low real-world exploitation probability, this represents a privilege escalation risk primarily for multi-vendor marketplace administrators.
Arbitrary content deletion in WordPress Ultimate Learning Pro plugin versions <= 3.9.3 allows authenticated high-privilege users to delete learning content without proper authorization checks. An attacker with instructor or administrator access can delete arbitrary posts, lessons, or courses, resulting in high integrity impact but no data theft or system disruption. The vulnerability is not known to be actively exploited and has very low exploitation likelihood (EPSS 0.05%).
Open redirect vulnerability in wpWax Directorist WordPress plugin versions up to 8.6.6 allows unauthenticated remote attackers to redirect users to arbitrary external websites via crafted URL parameters, enabling phishing attacks. The vulnerability requires user interaction (clicking a malicious link) but has a network attack vector with low complexity. EPSS exploitation probability is very low at 0.04%, and no active exploitation or public proof-of-concept has been identified.
Low-privileged authenticated users of the e-plugins Directory Pro WordPress plugin (<=2.5.6) can bypass access controls due to a missing authorization flaw, potentially modifying plugin data. The vulnerability has a medium CVSS score (4.3) with low integrity impact, and no active exploitation or public exploit has been reported; EPSS score of 0.05% indicates a low probability of in-the-wild attacks.
We are tasked to synthesize data from multiple intelligence sources about CVE-2025-59001 into a comprehensive analysis, returning a JSON object with specific fields. We need to cross-reference the data, provide original synthesis, and adhere to strict rules. Input data: - CVE ID: CVE-2025-59001 - Description: "Missing Authorization vulnerability in ThemeNectar Salient Core salient-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Salient Core: from n/a through <= 3.0.8." - CVSS Score: 4.3 - CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - CWE: CWE-862 (Missing Authorization) - EPSS Score: 0.05% (percentile 16%) - Reported by: audit@patchstack.com - Tags: Authentication Bypass (Note: tags might be from Patchstack, but we'll incorporate) - References: [nvd] (None) but actually a Patchstack URL: https://patchstack.com/database/Wordpress/Plugin/salient-core/vulnerability/wordpress-salient-core-plugin-3-0-8-broken-access-control-vulnerability?_s_id=cve - Also, there is no KEV status provided, no POC status mentioned. We must not assume KEV. Our exploitation status phrase: no public exploit identified at time of analysis (since no KEV, no POC stated). But wait, Patchstack might have reported, but we have no explicit "POC=YES" in the data. So we'll use that phrase. We need to fill fields: 1. product_name: "1-3 words ONLY. The specific product or service name affected." It's "Salient Core". That's a WordPress plugin by ThemeNectar. So "Salient Core" works. 2. summary: "2-3 sentence plain-language summary for security professionals. CRITICAL: Do NOT copy or paraphrase the Description — write an original synthesis using all available data. Do NOT start with 'A vulnerability', 'A problem', 'A flaw', or 'An issue'. Start with the specific impact verb and product, e.g. 'Remote code execution in Apache Tomcat 9.x allows...' or 'Cortex XDR agent on macOS can be disabled by local admins via...'. Explain WHAT the vulnerability is, WHO is affected (specific product/version), and WHAT an attacker can do. Mention if actively exploited (KEV), if POC exists, and EPSS risk if notable." So, missing authorization in Salient Core plugin <=3.0.8 allows authenticated users to exploit incorrectly configured access control to modify some data (I:L, integrity impact low, no confidentiality or availability). No active exploitation known, and EPSS is low (0.05%). So summary: "Authenticated attackers can exploit a missing authorization check in ThemeNectar Salient Core plugin versions through 3.0.8 to modify data without proper permissions. The vulnerability results from incorrectly configured access control security levels, with low integrity impact and no confidentiality or availability impact. EPSS probability is very low (0.05%), and no public exploit code or active exploitation has been identified at this time." That's original. 3. technical_context: "Explain the underlying technology/library/protocol involved. Use CPE data to identify exact affected products. Reference the CWE to explain the root cause class. Be specific and educational." No CPE data provided, so we can mention that CPE is not available, but the product is a WordPress plugin. We can talk about missing authorization (CWE-862) and how access control in WordPress plugins can be misconfigured. Also, the Patchstack link likely provides details. We'll say: "The Salient Core plugin for WordPress is affected by a missing authorization vulnerability (CWE-862). This class of weakness occurs when a web application does not properly restrict access to privileged functionality, allowing low-privileged authenticated users to perform actions that should require higher permissions. The vulnerability is in the plugin's access control mechanisms, which fail to enforce correct security levels. No CPE information is provided, but the vendor's plugin is available on WordPress.org or ThemeNectar's site." 4. risk_assessment: "Assess real-world risk using ALL available signals: CVSS vector (attack vector, complexity, privileges), EPSS exploitation probability, KEV status, POC availability, SSVC decision framework (exploitation status, automatable, technical impact). Compare and contrast these signals. Is this a real priority or just a high-CVSS-but-low-real-risk issue? If any key data is missing or conflicting, STATE IT EXPLICITLY, e.g.: 'CVSS indicates network vector but description implies local access — verify with vendor.' or 'EPSS score is low despite KEV listing, suggesting targeted rather than widespread exploitation.' Do NOT present uncertain information as confirmed fact." So here: CVSS 4.3, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. It's network exploitable, low complexity, low privileges required (authenticated, any user), no user interaction, unchanged scope, only integrity low impact. EPSS 0.05% (very low). No KEV, no POC. SSVC: exploitation=none (no public exploit), automatable=maybe (AC:L, but needs authentication, so perhaps not fully automatable without credentials), technical impact=partial (integrity modification). So risk is low. We'll say: "The CVSS score is low (4.3) due to limited impact, but the vector indicates an authenticated remote attack with low complexity. EPSS probability of exploitation is negligible (0.05%, percentile 16%), and there is no evidence of active exploitation or public exploit code. This vulnerability does not appear to be a high-priority threat, as it requires authentication and only allows integrity modification, not compromising confidential data or system availability. The missing authorization likely stems from a configuration specific to the plugin's access control levels, so risk is contextual." A note: no data conflicts; CVSS aligns with description. 5. affected_products: "Write a concise paragraph listing affected products with their versions. Include product name, version range, CPE if available, and link to vendor advisory from references. Do NOT use bullet points, JSON, or key-value formatting." So: "ThemeNectar Salient Core plugin for WordPress, versions from n/a through 3.0.8, are affected. The vendor advisory is available at https://patchstack.com/database/Wordpress/Plugin/salient-core/vulnerability/wordpress-salient-core-plugin-3-0-8-broken-access-control-vulnerability?_s_id=cve." (Use the reference link). No CPE mentioned, so skip that. 6. remediation: "Write a concise paragraph with actionable remediation steps. Start with the primary fix (patch/upgrade with exact version), then mention workarounds if relevant. Include advisory URLs from references. If no patch is available, suggest SPECIFIC compensating controls with their trade-offs — not generic 'apply defense in depth' but actionable: 'Disable X feature', 'Block Y port', 'Restrict access to Z endpoint'. Note side effects of each mitigation. Do NOT use bullet points, JSON, or key-value formatting." The description says "from n/a through <= 3.0.8", implying that version 3.0.8 is the highest affected, and presumably fixed in version above that, but no specific fix version is given. Patchstack advisory may have details. Since we only have the link, we can check if it says "Fixed in version: 3.0.9" or something. But we don't have that info from the input, just the URL. I can't access it, so I'll assume there is a patch. The data says "Missing Authorization vulnerability... This issue affects Salient Core: from n/a through <= 3.0.8." Typically, Patchstack entries include a fixed version. But in this input, no fix version explicitly. I'll phrase: "Upgrade Salient Core to a version newer than 3.0.8. The vendor has not explicitly announced a fixed version in the CVE data, but the advisory at Patchstack likely provides details. As a workaround, administrators can restrict access to the affected plugin's functionality by reviewing and hardening access control settings until an update is applied, though this may require manual configuration review." But we must not invent version numbers. If no patch is known, I will state that. However, given the structure, I'll say "Update to a patched version beyond 3.0.8" – but that is an inference. Better: "The advisory at Patchstack (see reference) indicates the vulnerability affects versions up to 3.0.8; update to the latest version, which should contain the fix. If no patch is yet available, restrict access to authenticated users with necessary roles, or disable the plugin temporarily. Disabling the plugin may affect functionality dependent on Salient Core." I'll incorporate the reference. 7. exploit_scenario: "Brief realistic attack scenario in 2-3 sentences. If POC exists, note that. Factor in attack vector and complexity from CVSS." No POC exists. Attack scenario: "An authenticated low-privileged user, such as a subscriber on a WordPress site, crafts a request to a Salient Core endpoint that lacks proper authorization checks. Due to missing access control, the user modifies settings or content they should not have permission to alter, leading to unauthorized data modification." This matches AV:N, PR:L, UI:N, I:L. 8. exploitation_conditions: "CRITICAL FIELD — security teams make real decisions based on this. Extract SPECIFIC, CONCRETE prerequisites from the CVE description. Name the EXACT product feature, protocol, configuration setting, or deployment mode required. If the description says 'when configured with...' or 'if the X feature is enabled' — that IS the condition. If genuinely no special conditions (AV:N/AC:L/PR:N/UI:N), state: 'No special conditions — remote unauthenticated exploitation against default configurations of [PRODUCT NAME].' Also state what LIMITS exploitation: required user interaction, authentication level, non-default configuration, specific platform/version. These limiting factors help defenders assess realistic risk beyond raw CVSS score. FORBIDDEN generic phrases: 'Network access required.' / 'Specific configuration needed.' / 'Depends on deployment.'" From the description: "Missing Authorization vulnerability ... allows Exploiting Incorrectly Configured Access Control Security Levels." This implies that the vulnerability is due to incorrectly configured access control security levels. So the condition might be that access control security levels are not correctly configured. However, the CVSS vector has PR:L, so it requires authentication with low privileges. So specific conditions: "Exploitation requires an authenticated user with low privileges (e.g., subscriber) on a WordPress site where the Salient Core plugin is active. The vulnerability manifests when access control security levels are misconfigured, potentially due to the plugin's default settings. No user interaction is required. No other special conditions; the attack vector is network-based, and complexity is low." That's specific enough. The "incorrectly configured" might be inherent to the plugin's code rather than a site-specific misconfiguration, but it's a missing authorization check. So I'll phrase: "Exploitation requires an authenticated low-privilege user account on a WordPress instance running Salient Core 3.0.8 or earlier. The vulnerability exists in the plugin's access control mechanisms, specifically when handling requests to certain endpoints where permissions are not properly enforced. No other prerequisites such as enabled features or non-default settings are needed, but the attacker must have valid credentials." 9. attack_chain: "3-7 short steps separated by ' → ' (arrow), following kill chain phases. Use as many steps as the attack realistically requires. Each step is 3-8 words. Must be grounded in actual CVE data (attack vector, privileges, scope from CVSS). Phase templates by length: 3-step: Access → Exploit → Impact. 4-step: Access → Exploit → Execution → Impact. 5-step: Access → Delivery → Exploit → Execution → Impact. 6-step: Access → Delivery → Exploit → Execution → Persist → Impact. 7-step: Recon → Delivery → Exploit → Install → C2 → Execute → Impact. Example: 'Send crafted HTTP request → Trigger buffer overflow in parser → Execute arbitrary code as root'. No numbering, no prose, just the chain." So: Access: "Authenticate with low-privilege user account" -> Exploit: "Send request to unprotected endpoint" (or "Craft request to bypass authorization") -> Impact: "Modify data without proper authorization". That's 3 steps: "Authenticate as low-privileged user → Send crafted request to missing-auth endpoint → Unauthorized data modification". Alternatively, could be 4 steps: Access -> Delivery (sending the request) -> Exploit (the missing check allows access) -> Impact. But 3 steps suffices: "Access: obtain low-privilege credentials" → "Exploit: invoke
Authenticated low-privileged users can exploit missing authorization in the Accessibility by AudioEye WordPress plugin (≤1.0.49) to modify plugin data, resulting in a limited integrity impact. The vulnerability allows attackers with subscriber roles to bypass access controls on plugin endpoints, though no active exploitation or public exploit code is currently known. The CVSS score of 4.3 reflects its low severity.
Unauthorized access to attachment management exists in the Import external attachments WordPress plugin, allowing low-privileged users to modify external attachment settings or data without proper authorization checks. Versions up to 1.5.12 are vulnerable, and remote attackers with subscriber-level or similar accounts can exploit this missing authorization (CWE-862). No active exploitation or public proof-of-concept code is reported at the time of analysis, and EPSS indicates a low exploitation probability (0.05%).
Unauthorized modification of Elementor widget restrictions in the Restrict Elementor Widgets plugin for WordPress allows authenticated users with low privileges to bypass access controls. Affecting versions up to and including 1.12, this missing authorization flaw can be exploited to alter widget, column, and section restrictions without proper permissions. No active exploitation is confirmed, and the EPSS score remains low at 0.05%.
Authenticated attackers with low-level privileges can modify plugin data in the WP Coupons and Deals WordPress plugin through version 3.2.4 due to missing authorization checks. This integrity-only impact (CVSS 4.3) requires an already-authorized low-privilege user account, limiting risk. No active exploitation has been reported, and the EPSS probability is 0.05% (14th percentile), indicating very low exploitation likelihood.
Authenticated low-privilege attackers can bypass access controls in the WPS Bidouille WordPress plugin through version 1.33.1, allowing unauthorized modification of plugin data. The vulnerability has a low EPSS score (0.05%) and no public exploit or active exploitation is currently reported.
Missing authorization in the SKT Page Builder WordPress plugin allows authenticated attackers to modify page content. The vulnerability permits low-privilege users (e.g., subscribers) to perform unauthorized actions due to incorrectly configured access control security levels. No public exploit or active exploitation is confirmed, but the low privilege requirement poses a moderate insider threat risk.
Missing authorization in the WordPress Read More & Accordion plugin (expand-maker) versions 3.5.5.1 and earlier allows authenticated users to access restricted functionality through incorrectly configured access controls, potentially revealing sensitive information. The vulnerability requires user authentication and network access but carries a CVSS score of 6.5 due to high confidentiality impact, though real-world exploitation probability remains low at 0.04% EPSS. No public exploit code or active exploitation has been identified at time of analysis.
Inadequately configured access control in Easy Property Listings WordPress plugin versions 3.5.21 and earlier allows authenticated users to access sensitive information they should not be authorized to view. An authenticated attacker with user-level privileges can bypass authorization checks to read property listing data or other restricted content due to missing authorization validation on API endpoints or functionality. EPSS exploitation probability is very low at 0.04%, and no public exploit code has been identified, indicating limited real-world threat despite the authentication-bypass tag.
Authenticated users with limited privileges can access search and replace functionality in CM On Demand Search And Replace WordPress plugin (versions up to 1.5.5) due to missing authorization checks on restricted features. An attacker with basic user credentials can perform privileged actions intended only for administrators, affecting data confidentiality through unauthorized content access. This is confirmed as an authentication bypass vulnerability with low real-world exploitation probability (EPSS 0.04%) despite the missing authorization flaw.