What is the CVSS score of CVE-2025-13403?

CVE-2025-13403 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2025-13403

MEDIUM

Missing Authorization (CWE-862)

2025-12-13 security@wordfence.com

Authentication Bypass WordPress

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 08, 2026 - 17:22 vuln.today

CVE Published

Dec 13, 2025 - 16:16 nvd

MEDIUM 4.3

DescriptionCVE.org

The Employee Spotlight - Team Member Showcase & Meet the Team Plugin for WordPress is vulnerable to unauthorized tracking settings modification due to missing authorization validation on the employee_spotlight_check_optin() function in all versions up to, and including, 5.1.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enable or disable tracking settings.

AnalysisAI

Authenticated attackers with Subscriber-level access can modify tracking settings in the Employee Spotlight WordPress plugin (versions up to 5.1.3) due to missing authorization checks in the employee_spotlight_check_optin() function. The vulnerability allows privilege escalation to perform account integrity modifications that should require administrator approval, affecting all installations of this plugin without patches applied.

Technical ContextAI

The Employee Spotlight plugin for WordPress implements a feedback/tracking opt-in mechanism via the employee_spotlight_check_optin() function in plugin-feedback-functions.php. The function processes user requests to modify tracking preferences but fails to validate that the requesting user has the necessary administrative capabilities before applying changes to global tracking settings. This is a classic authorization bypass (CWE-862: Missing Authorization) where the plugin checks for user authentication (PR:L in CVSS indicates Login required) but omits the capability check that would restrict this action to administrators. WordPress capability checks typically use functions like current_user_can('manage_options') or similar administrative gates. Without this validation, any authenticated user-including those with minimal Subscriber privileges-can invoke the function to toggle tracking settings, violating the principle of least privilege and enabling privilege escalation attacks.

Affected ProductsAI

The Employee Spotlight - Team Member Showcase & Meet the Team WordPress plugin is vulnerable in all versions up to and including 5.1.3. The vulnerable code is located in the includes/plugin-feedback-functions.php file in the employee_spotlight_check_optin() function. WordPress sites running this plugin with versions 5.1.3 or earlier are affected if they permit user registration or have existing non-administrator user accounts. The plugin is distributed via the WordPress plugin repository at plugins.trac.wordpress.org/browser/employee-spotlight.

RemediationAI

Update the Employee Spotlight plugin to version 5.1.4 or later, which includes authorization validation in the employee_spotlight_check_optin() function. Site administrators should navigate to WordPress Admin → Plugins, locate Employee Spotlight, and click Update if available. As a temporary mitigation prior to patching, restrict user registration on the WordPress site or disable the Employee Spotlight plugin entirely. Review and audit any tracking settings modifications that may have occurred if the plugin was exposed to untrusted users. For technical details and vendor confirmation, consult the Wordfence vulnerability report at https://www.wordfence.com/threat-intel/vulnerabilities/id/19738a82-8c31-45bb-a869-68e357299eb5?source=cve and review the plugin changeset and source code at the WordPress plugin repository references provided.