What is the CVSS score of CVE-2025-5486?

CVE-2025-5486 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of PHP are affected by CVE-2025-5486?

An unauthenticated attacker can exploit the WP Email Debug plugin to intercept administrator password reset emails and gain administrative access to WordPress installations.

How to fix or mitigate CVE-2025-5486?

Within 24 hours: Identify all instances of WP Email Debug plugin across your infrastructure and disable or uninstall it immediately; if business-critical, isolate affected systems from production. Within 7 days: Audit all administrator accounts for unauthorized access or password changes; review email logs for suspicious forwarding rules. Within 30 days: Once a patch is released, evaluate the updated plugin thoroughly in a test environment before re-enabling in production; consider alternative email debugging solutions from trusted vendors.

PHP CVE-2025-5486

EUVD-2025-17069 CRITICAL

Missing Authorization (CWE-862)

2025-06-06 security@wordfence.com

WordPress Privilege Escalation PHP

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 18:10 euvd

EUVD-2025-17069

Analysis Generated

Mar 14, 2026 - 18:10 vuln.today

CVE Published

Jun 06, 2025 - 07:15 nvd

CRITICAL 9.8

DescriptionCVE.org

The WP Email Debug plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the WPMDBUG_handle_settings() function in versions 1.0 to 1.1.0. This makes it possible for unauthenticated attackers to enable debugging and send all emails to an attacker controlled address and then trigger a password reset for an administrator to gain access to an administrator account.

AnalysisAI

The WP Email Debug WordPress plugin (versions 1.0-1.1.0) contains a critical privilege escalation vulnerability (CVE-2025-5486) stemming from missing capability checks in the WPMDBUG_handle_settings() function. Unauthenticated attackers can exploit this to modify plugin settings, redirect administrator emails to attacker-controlled addresses, and trigger password resets to gain full administrative access to affected WordPress installations. The CVSS 9.8 score reflects network-based exploitation with zero complexity and no authentication required, representing a critical severity threat with high real-world exploitation potential.

Technical ContextAI

The vulnerability exists in the WP Email Debug plugin's WPMDBUG_handle_settings() function, which processes settings changes without validating user capabilities via WordPress' capability checking system (typically using functions like current_user_can()). This is a textbook example of CWE-862 (Missing Authorization), where an application exposes functionality that should be restricted to authenticated administrative users. The plugin likely uses WordPress AJAX handlers or admin-ajax.php endpoints to process settings modifications; the missing capability check allows unauthenticated users (or low-privilege users) to reach code that should be reserved for administrators. By manipulating plugin settings through direct function calls or AJAX requests, attackers can reconfigure email routing and enable debugging features meant only for site administrators. The attack leverages WordPress' authentication system failure rather than a cryptographic or protocol-level flaw.

RemediationAI

Immediate actions: (1) Update WP Email Debug plugin to version 1.1.1 or later (patch version must include capability checks in WPMDBUG_handle_settings() function); (2) For installations unable to patch immediately, disable or deactivate the WP Email Debug plugin via wp-admin dashboard or wp-cli (wp plugin deactivate wp-email-debug); (3) Review plugin settings to confirm no unauthorized email redirects or debugging configurations are in place; (4) Audit WordPress user accounts and administrator roles for unauthorized access created during the vulnerability window. Vendor advisory and patch should be obtained from wordpress.org plugin repository or the plugin's official GitHub/support channels. Implement Web Application Firewall (WAF) rules to block requests to WPMDBUG_handle_settings() from unauthenticated users as a temporary network-level mitigation. Long-term: consider plugin replacement with actively maintained debugging solutions that follow WordPress capability-checking best practices.