What is the CVSS score of CVE-2025-49937?

CVE-2025-49937 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Smash Balloon Social Post Feed CVE-2025-49937

MEDIUM

Missing Authorization (CWE-862)

2025-10-22 audit@patchstack.com

WordPress Authentication Bypass Wordpress Plugin

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Low-privilege authenticated network attack with only low integrity impact; no confidentiality or availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 18:41 vuln.today

CVE Published

Oct 22, 2025 - 15:15 cve.org

MEDIUM 4.3

DescriptionCVE.org

Missing Authorization vulnerability in Syed Balkhi Smash Balloon Social Post Feed custom-facebook-feed allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Smash Balloon Social Post Feed: from n/a through <= 4.3.2.

AnalysisAI

Broken access control in the Smash Balloon Social Post Feed WordPress plugin (versions up to and including 4.3.2) allows authenticated users with low privileges to perform unauthorized modifications of social feed data or settings due to missing authorization checks. No active exploitation or public exploit has been identified at this time, and EPSS indicates very low exploitation probability.

Technical ContextAI

The vulnerability stems from CWE-862 Missing Authorization within the WordPress plugin 'custom-facebook-feed' (Smash Balloon Social Post Feed). This class of flaw arises when the code does not verify that a user possesses the required capabilities before processing a privileged request. The affected plugin integrates Facebook feeds into WordPress sites and its access control mechanism incorrectly trusts all authenticated requests, allowing low‑privilege roles to perform actions intended only for higher‑privileged users. No specific configuration changes are required for exploitation - the vulnerability exists in the default installation.

Affected ProductsAI

The Smash Balloon Social Post Feed (formerly Custom Facebook Feed) WordPress plugin, versions n/a through 4.3.2, is affected. The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/custom-facebook-feed/vulnerability/wordpress-smash-balloon-social-post-feed-plugin-4-3-2-broken-access-control-vulnerability?_s_id=cve documents the issue and lists the vulnerable version range.

RemediationAI

Update the Smash Balloon Social Post Feed plugin to the latest available version. The vendor is expected to have included a fix for the missing authorization check in a release following version 4.3.2; refer to the plugin changelog or the Patchstack advisory for the specific patched version. If immediate updating is not possible, consider restricting access to the plugin’s administrative interfaces to trusted, high‑privilege accounts only, although this may disrupt normal workflow for legitimate content editors. As a last resort, temporarily disabling the plugin will eliminate the attack surface, at the cost of removing the social feed functionality from the site.