What is the CVSS score of CVE-2025-23974?

CVE-2025-23974 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Wordpress Plugin are affected by CVE-2025-23974?

A privilege escalation vulnerability in ifkooo One-Login (versions through 1.4) allows authenticated attackers to gain elevated system access without authorization.

How to fix or mitigate CVE-2025-23974?

Within 24 hours: Identify all systems running ifkooo One-Login 1.4 or earlier and document inventory; review recent access logs for suspicious privilege escalation attempts. Within 7 days: Implement network segmentation to restrict One-Login system access; enforce additional authentication factors for administrative functions; contact ifkooo for patch timeline and interim guidance. Within 30 days: Deploy patch immediately upon availability; conduct forensic analysis of logs for potential exploitation; perform access control audit across affected systems.

Wordpress Plugin CVE-2025-23974

EUVD-2025-17478 HIGH

Incorrect Privilege Assignment (CWE-266)

2025-06-09 audit@patchstack.com

WordPress Privilege Escalation Wordpress Plugin

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

EUVD ID Assigned

Mar 14, 2026 - 19:21 euvd

EUVD-2025-17478

Analysis Generated

Mar 14, 2026 - 19:21 vuln.today

CVE Published

Jun 09, 2025 - 16:15 nvd

HIGH 8.1

DescriptionCVE.org

Incorrect Privilege Assignment vulnerability in ifkooo One-Login allows Privilege Escalation. This issue affects One-Login: from n/a through 1.4.

AnalysisAI

CVE-2025-23974 is an Incorrect Privilege Assignment vulnerability in ifkooo One-Login that enables unauthenticated remote privilege escalation. Versions 1.4 and earlier are affected, allowing attackers to gain high-impact unauthorized access to sensitive functions without user interaction. The CVSS 8.1 score reflects significant risk, though the high attack complexity (AC:H) suggests exploitation requires specific conditions; KEV/POC status and active exploitation data are not available in provided intelligence.

Technical ContextAI

The vulnerability stems from CWE-266 (Incorrect Privilege Assignment), a class of flaws where the application fails to properly assign or validate user privilege levels during authentication or authorization checks. In ifkooo One-Login, this likely manifests as improper role-based access control (RBAC) or capability-based security enforcement in the Single Sign-On (SSO) mechanism. The flaw allows an unauthenticated attacker (PR:N) to bypass privilege assignment logic and obtain administrative or elevated privileges over the authentication/authorization service. The vulnerability is not confined to a specific version range notation ('n/a through 1.4'), suggesting it affects all known releases up to and including version 1.4. CPE data specific to ifkooo One-Login product identifiers would typically be structured as 'cpe:2.3:a:ifkooo:one-login:*:*:*:*:*:*:*:*' with version constraints <=1.4.

RemediationAI

Upgrade ifkooo One-Login to version 1.5 or later (exact patched version not specified in provided data; verify with ifkooo security advisory for confirmed fix version).; priority: High; notes: Contact ifkooo support or monitor their security advisories for release of patched version. Version 1.5 or higher should address the CWE-266 privilege assignment logic. Workaround: Implement network-level access controls: restrict network access to One-Login services to trusted administrative networks only. Disable external/untrusted user access to One-Login endpoints until patch is applied.; priority: Medium; applicability: Temporary mitigation; not a substitute for patching. Mitigation: Monitor authentication logs and privilege assignment events for anomalies indicating unauthorized privilege escalation. Implement additional MFA/step-up authentication for sensitive SSO operations.; priority: Medium; applicability: Reduces attack surface while patch is pending. Advisory Reference: Review official ifkooo security advisories and vendor patches. No direct links available in provided intelligence; consult ifkooo's security portal or contact vendor directly.; priority: Critical for validation