Admin Management Xtended CVE-2025-62965
MEDIUMSeverity by source
AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L
Missing authorization on admin endpoints is low-complexity once authenticated; PR:L reflects typical contributor/editor-level access needed; no availability impact identified.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionCVE.org
Missing Authorization vulnerability in wpseek Admin Management Xtended admin-management-xtended allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Admin Management Xtended : from n/a through <= 2.5.1.
AnalysisAI
Missing authorization checks in the Admin Management Xtended WordPress plugin (versions through 2.5.1) allow authenticated users to exploit incorrectly configured access control levels, performing administrative operations beyond their assigned role boundary. The CVSS scope change component (S:C) signals the vulnerability's impact crosses the exploiting user's permission boundary within the WordPress installation, enabling privilege escalation within the CMS. No public exploit code has been identified at time of analysis, and the EPSS score of 0.05% (16th percentile) indicates very low real-world exploitation probability currently.
Technical ContextAI
Admin Management Xtended (plugin slug: admin-management-xtended, vendor: wpseek) is a WordPress plugin that extends the built-in WordPress admin panel with additional management capabilities. CWE-862 (Missing Authorization) identifies the root cause: the plugin performs privileged administrative operations without calling WordPress capability checks - typically implemented via current_user_can() - to verify the requesting user's role and permissions. The CVSS S:C (scope changed) metric indicates the vulnerable operations affect resources or security contexts beyond the authenticated user's own permission scope, consistent with a privilege boundary crossing within WordPress's role model (Subscriber → Contributor → Editor → Administrator). The AC:H (High Complexity) rating in the provided vector suggests exploitation is not trivially reproducible - there may be race conditions, specific configuration states, or contextual prerequisites beyond simply possessing a WordPress login.
Affected ProductsAI
The vulnerability affects the Admin Management Xtended WordPress plugin by wpseek, all versions from the initial release through and including version 2.5.1. The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/admin-management-xtended/vulnerability/wordpress-admin-management-xtended-plugin-2-5-1-broken-access-control-vulnerability is the canonical reference. No CPE string was included in the NVD entry; the affected component is identified by its WordPress.org plugin slug admin-management-xtended. No patched version number is independently confirmed from available data.
RemediationAI
Consult the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/admin-management-xtended/vulnerability/wordpress-admin-management-xtended-plugin-2-5-1-broken-access-control-vulnerability to determine whether a patched release above 2.5.1 has been published and upgrade immediately if available; no exact fix version is independently confirmed from the data provided. If no patch is yet available, the most effective compensating control is to temporarily deactivate the Admin Management Xtended plugin - this eliminates the attack surface entirely at the cost of losing the extended admin management functionality it provides. Alternatively, restrict WordPress admin panel access (wp-admin) to trusted IP ranges at the web server or WAF level, reducing the pool of potential actors who can reach the vulnerable endpoints. Additionally, audit all WordPress user accounts to ensure only fully trusted personnel hold contributor-level or higher roles, minimizing the blast radius of any exploitation attempt. Monitor the plugin's WordPress.org changelog and Patchstack database entry for a patched release.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today