Evergreen Content Poster CVE-2025-64234
MEDIUMSeverity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Network-accessible WordPress plugin requiring authenticated low-privilege user; added I:L to reflect potential unauthorized state changes consistent with the Authentication Bypass tag.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionCVE.org
Missing Authorization vulnerability in Evergreen Content Poster Evergreen Content Poster evergreen-content-poster allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Evergreen Content Poster: from n/a through <= 1.4.5.
AnalysisAI
Broken access control in the Evergreen Content Poster WordPress plugin (versions through 1.4.5) permits authenticated low-privilege users to invoke restricted plugin functionality without proper authorization checks. The root cause is CWE-862 (Missing Authorization), where the plugin fails to verify whether the requesting user holds the appropriate role before executing sensitive operations - allowing, at minimum, availability-impacting disruption to content scheduling workflows. No public exploit code has been identified at time of analysis, and the EPSS score of 0.03% (10th percentile) signals minimal observed exploitation activity.
Technical ContextAI
The Evergreen Content Poster is a WordPress plugin designed to automate recurring or evergreen content publishing. WordPress plugins commonly register AJAX handlers or REST API endpoints that must explicitly call capability checks (e.g., current_user_can()) before processing privileged requests. CWE-862 (Missing Authorization) describes the failure to perform such checks, meaning any authenticated WordPress user - regardless of role - can reach endpoints or trigger actions gated on higher privilege levels. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms network-reachable exploitation requiring only low-level authentication, consistent with a WordPress subscriber or contributor account sending crafted requests to an unprotected plugin endpoint. The impacted CPE corresponds to the evergreen-content-poster plugin through version 1.4.5 in the WordPress plugin ecosystem.
Affected ProductsAI
The Evergreen Content Poster WordPress plugin by the vendor 'Evergreen Content Poster' is affected in all versions from n/a through and including version 1.4.5. No CPE string was provided in the input data; the affected component is identified as the 'evergreen-content-poster' plugin in the WordPress plugin repository. The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/evergreen-content-poster/vulnerability/wordpress-evergreen-content-poster-plugin-1-4-5-broken-access-control-vulnerability is the primary reference for affected version scope.
RemediationAI
WordPress site administrators should update the Evergreen Content Poster plugin to a version above 1.4.5 once a patched release is made available by the vendor; no specific fix version has been confirmed in the available data. In the interim, if the plugin is not actively required, deactivating or uninstalling it eliminates the attack surface entirely without meaningful trade-offs for sites not dependent on the feature. If the plugin must remain active, restricting WordPress user registration and limiting the minimum authenticated role that can access the site reduces the pool of potential attackers - this is especially relevant if the plugin's vulnerable endpoint is only reachable by logged-in users. Monitor the Patchstack advisory page at https://patchstack.com/database/Wordpress/Plugin/evergreen-content-poster/vulnerability/wordpress-evergreen-content-poster-plugin-1-4-5-broken-access-control-vulnerability for patch version confirmation.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today