What is the CVSS score of CVE-2025-49349?

CVE-2025-49349 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Wordpress Plugin CVE-2025-49349

MEDIUM

Missing Authorization (CWE-862)

2025-12-31 audit@patchstack.com

WordPress Authentication Bypass Wordpress Plugin

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

CVSS changed

Apr 23, 2026 - 15:43 NVD

5.3 (MEDIUM)

Analysis Generated

Apr 01, 2026 - 17:44 vuln.today

CVE Published

Dec 31, 2025 - 15:15 nvd

N/A

DescriptionCVE.org

Missing Authorization vulnerability in Reuters News Agency Reuters Direct reuters-direct allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Reuters Direct: from n/a through <= 3.0.0.

AnalysisAI

Reuters Direct WordPress plugin through version 3.0.0 contains a missing authorization vulnerability allowing attackers to bypass access control restrictions and access protected functionality without proper authentication. The vulnerability stems from incorrectly configured access control security levels in the plugin, potentially enabling unauthenticated users to interact with sensitive features intended for authorized administrators or subscribers. With an EPSS score of 0.04% and low real-world exploitation signals, this issue presents minimal immediate risk but should be addressed through plugin updates.

Technical ContextAI

This vulnerability is classified as CWE-862 (Missing Authorization), a flaw in access control implementation where the application fails to properly verify that users have the necessary permissions before granting access to restricted resources or functions. In the context of the Reuters Direct WordPress plugin, the root cause involves incorrectly configured access control security levels within the plugin's codebase. WordPress plugins relying on improperly implemented capability checks or REST API endpoints without proper permission verification are susceptible to this class of vulnerability. The plugin's failure to enforce authorization checks means that access control decisions are either absent, bypassable, or misconfigured at the application layer.

Affected ProductsAI

Reuters Direct WordPress plugin versions from an unspecified baseline through and including version 3.0.0 are affected. The plugin is distributed through the WordPress plugin repository and is identified by the CPE reference related to WordPress plugin reuters-direct. All installations running version 3.0.0 or earlier with this plugin active should be considered vulnerable to unauthorized access if the misconfigured access control is exploitable for the user's specific deployment.

RemediationAI

Update the Reuters Direct WordPress plugin to the latest available version beyond 3.0.0. Users should access the WordPress dashboard, navigate to Plugins, locate Reuters Direct, and click Update if an available version is displayed. If no newer version is available in the WordPress plugin repository, contact the Reuters Direct plugin vendor directly or consult the official advisory at https://patchstack.com/database/Wordpress/Plugin/reuters-direct/vulnerability/wordpress-reuters-direct-plugin-3-0-0-broken-access-control-vulnerability for specific patch guidance. As a temporary workaround, administrators may restrict plugin capabilities through user role management or disable the plugin entirely until a patched version is released. Ensure proper WordPress user role and capability assignments are in place to enforce access restrictions independently of the plugin.