CVE-2025-69016
MEDIUMCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Lifecycle Timeline
2Description
Missing Authorization vulnerability in averta Shortcodes and extra features for Phlox theme auxin-elements allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Shortcodes and extra features for Phlox theme: from n/a through <= 2.17.15.
Analysis
Authenticated users without proper authorization can modify content in the auxin-elements WordPress plugin (versions up to 2.17.15) due to missing access control checks on shortcode functionality. The vulnerability requires an authenticated account with low privileges and allows integrity compromise through shortcode manipulation, with an EPSS score of 0.04% indicating low real-world exploitation likelihood despite confirmed access control weakness.
Technical Context
The auxin-elements plugin for the Phlox WordPress theme implements shortcode functionality that fails to properly validate user capabilities before allowing modifications. CWE-862 (Missing Authorization) indicates the plugin lacks proper access control enforcement on administrative or sensitive operations. The vulnerability exists in the shortcode processing logic where capability checks are either missing or incorrectly configured, allowing authenticated users with the PR:L (low privileges, such as contributor or author roles) to perform actions normally restricted to higher-privilege accounts. WordPress role-based access control relies on explicit capability checks via functions like current_user_can(), and this plugin fails to implement these checks consistently across its shortcode handlers.
Affected Products
The vulnerability affects Shortcodes and extra features for Phlox theme (auxin-elements) in all versions from the earliest tracked through and including version 2.17.15. The affected plugin is commonly identified by CPE patterns referencing WordPress plugins (CPE for WordPress plugins typically formatted as cpe:2.3:a:wordpress:auxin-elements). The Patchstack reference indicates the vulnerability was identified in version 2.17.12 and affects all versions up to the stated maximum of 2.17.15, suggesting recent plugin development was occurring at the time of discovery. Users running any version of auxin-elements at or below 2.17.15 are potentially affected.
Remediation
Users should immediately update the auxin-elements plugin to a version newer than 2.17.15; vendors typically release patched versions addressing CWE-862 authorization issues within minor or patch increments. Check the WordPress plugin repository or the vendor's release notes for the next available version following 2.17.15, which should contain proper capability checks via current_user_can() on all affected shortcode operations. As an interim mitigation, WordPress site administrators can restrict plugin access by limiting which user roles are allowed to create or edit posts/pages containing the affected shortcodes, and by enforcing strict user role policies to minimize the number of accounts holding contributor or author privileges. For detailed patch information and vulnerability specifics, refer to the Patchstack vulnerability database entry at https://patchstack.com/database/Wordpress/Plugin/auxin-elements/vulnerability/wordpress-shortcodes-and-extra-features-for-phlox-theme-plugin-2-17-12-broken-access-control-vulnerability.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today