What is the CVSS score of CVE-2025-4202?

CVE-2025-4202 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Multicollab WordPress Plugin CVE-2025-4202

EUVD-2025-209886 MEDIUM

Missing Authorization (CWE-862)

2026-05-16 Wordfence

GHSA-f4x8-m8jx-pfpg

Authentication Bypass WordPress

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 16, 2026 - 12:57 vuln.today

DescriptionCVE.org

The Multicollab: Content Team Collaboration and Editorial Workflow plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'cf_add_comment' function in all versions up to, and including, 5.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to add comments to arbitrary collaborations.

AnalysisAI

Authorization bypass in Multicollab WordPress plugin allows authenticated attackers with Subscriber-level privileges to inject comments into arbitrary editorial collaborations. This affects all versions up to and including 5.2. While CVSS rates this 4.3 (Low), the ability for low-privileged users to pollute editorial workflows could enable social engineering, misinformation injection into content review processes, or disruption of collaborative editing. EPSS data not provided. No active exploitation confirmed (not in CISA KEV). Patch available in version 3519252 per WordPress plugin repository changeset.

Technical ContextAI

This vulnerability stems from CWE-862 (Missing Authorization Check) in the 'cf_add_comment' function within the Multicollab plugin's class-commenting-block-admin.php file. Multicollab is a WordPress plugin enabling editorial teams to collaborate on content through inline comments and workflow management. The affected function fails to validate whether the authenticated user has appropriate capabilities before allowing comment creation on collaboration objects. WordPress uses a tiered capability system (Subscriber < Contributor < Author < Editor < Administrator), and proper authorization checks should restrict comment creation to users with legitimate editorial roles. The missing check allows any authenticated user, including Subscribers who normally have minimal permissions (can only read content and manage their own profile), to invoke the comment addition functionality on any collaboration thread regardless of their actual involvement in that editorial process.

RemediationAI

Update Multicollab plugin to the patched version corresponding to WordPress plugin changeset 3519252 or later, available at https://plugins.trac.wordpress.org/changeset/3519252/. WordPress administrators should navigate to Plugins > Installed Plugins, locate Multicollab, and click Update if available. If automatic updates are not yet distributed, download the latest version from the official WordPress plugin repository. As a temporary workaround until patching, restrict user registration to prevent untrusted Subscriber account creation (Settings > General > Membership: uncheck 'Anyone can register'), or use a role management plugin to audit and remove unnecessary Subscriber accounts. Note that disabling user registration may impact legitimate site functionality if public registration is required. For sites requiring open registration, consider implementing additional access controls at the web application firewall level to restrict admin-ajax.php requests from Subscriber-role users, though this may cause compatibility issues with other plugins and requires careful testing.