What is the CVSS score of CVE-2025-49925?

CVE-2025-49925 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

WPLMS CVE-2025-49925

HIGH

Missing Authorization (CWE-862)

2025-10-22 audit@patchstack.com

WordPress Authentication Bypass Wordpress Learning Management System Wordpress Plugin Vibethemes

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Network-accessible endpoint bypasses authorization, requiring no privileges and reading sensitive data.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 18:41 vuln.today

CVE Published

Oct 22, 2025 - 15:15 cve.org

HIGH 7.5

DescriptionCVE.org

Missing Authorization vulnerability in VibeThemes WPLMS wplms_plugin allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WPLMS: from n/a through <= 1.9.9.7.

AnalysisAI

Unauthenticated information disclosure in the VibeThemes WPLMS WordPress plugin (≤1.9.9.7) allows remote attackers to access restricted functionality and read sensitive data without any interaction or privileges. The vulnerability stems from a missing authorization check, making exploitation trivial, though EPSS indicates a low probability of real-world exploitation at this time.

Technical ContextAI

The WPLMS plugin (cpe:2.3:a:vibethemes:wordpress_learning_management_system) is a PHP-based Learning Management System for WordPress. The root cause is CWE-862 (Missing Authorization), meaning a critical access control check was omitted from one or more of its exposed endpoints (e.g., REST API routes or AJAX handlers). Without proper capability checks, any remote actor can invoke functions intended only for authorized users, exposing confidential data.

RemediationAI

Update the WPLMS plugin to a version later than 1.9.9.7 (likely 1.9.9.8 or higher) as soon as the vendor releases a patch. If no update is immediately available, consider disabling the plugin until a fixed version is provided, or restrict access to the WordPress admin area and any exposed API endpoints (though this may be impractical for public-facing sites). The vendor advisory is expected to include the exact fix version; monitor the Patchlink for updates. As a compensating control, a Web Application Firewall can be configured to block requests targeting known vulnerable endpoints, though this may result in false positives if the endpoints are also used by legitimate users.