CVE-2025-13403
MEDIUMCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Lifecycle Timeline
2Description
The Employee Spotlight - Team Member Showcase & Meet the Team Plugin for WordPress is vulnerable to unauthorized tracking settings modification due to missing authorization validation on the employee_spotlight_check_optin() function in all versions up to, and including, 5.1.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enable or disable tracking settings.
Analysis
Authenticated attackers with Subscriber-level access can modify tracking settings in the Employee Spotlight WordPress plugin (versions up to 5.1.3) due to missing authorization checks in the employee_spotlight_check_optin() function. The vulnerability allows privilege escalation to perform account integrity modifications that should require administrator approval, affecting all installations of this plugin without patches applied.
Technical Context
The Employee Spotlight plugin for WordPress implements a feedback/tracking opt-in mechanism via the employee_spotlight_check_optin() function in plugin-feedback-functions.php. The function processes user requests to modify tracking preferences but fails to validate that the requesting user has the necessary administrative capabilities before applying changes to global tracking settings. This is a classic authorization bypass (CWE-862: Missing Authorization) where the plugin checks for user authentication (PR:L in CVSS indicates Login required) but omits the capability check that would restrict this action to administrators. WordPress capability checks typically use functions like current_user_can('manage_options') or similar administrative gates. Without this validation, any authenticated user-including those with minimal Subscriber privileges-can invoke the function to toggle tracking settings, violating the principle of least privilege and enabling privilege escalation attacks.
Affected Products
The Employee Spotlight - Team Member Showcase & Meet the Team WordPress plugin is vulnerable in all versions up to and including 5.1.3. The vulnerable code is located in the includes/plugin-feedback-functions.php file in the employee_spotlight_check_optin() function. WordPress sites running this plugin with versions 5.1.3 or earlier are affected if they permit user registration or have existing non-administrator user accounts. The plugin is distributed via the WordPress plugin repository at plugins.trac.wordpress.org/browser/employee-spotlight.
Remediation
Update the Employee Spotlight plugin to version 5.1.4 or later, which includes authorization validation in the employee_spotlight_check_optin() function. Site administrators should navigate to WordPress Admin → Plugins, locate Employee Spotlight, and click Update if available. As a temporary mitigation prior to patching, restrict user registration on the WordPress site or disable the Employee Spotlight plugin entirely. Review and audit any tracking settings modifications that may have occurred if the plugin was exposed to untrusted users. For technical details and vendor confirmation, consult the Wordfence vulnerability report at https://www.wordfence.com/threat-intel/vulnerabilities/id/19738a82-8c31-45bb-a869-68e357299eb5?source=cve and review the plugin changeset and source code at the WordPress plugin repository references provided.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today