What is the CVSS score of CVE-2025-69016?

CVE-2025-69016 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

PHP CVE-2025-69016

Q: Which versions of PHP are affected by CVE-2025-69016?

Authenticated users without proper authorization can modify content in the auxin-elements WordPress plugin (versions up to 2.17.15) due to missing access control checks on shortcode functionality.

MEDIUM

Missing Authorization (CWE-862)

2025-12-30 audit@patchstack.com

WordPress PHP Authentication Bypass

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 01, 2026 - 15:22 vuln.today

CVE Published

Dec 30, 2025 - 11:15 nvd

MEDIUM 4.3

DescriptionCVE.org

Missing Authorization vulnerability in averta Shortcodes and extra features for Phlox theme auxin-elements allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Shortcodes and extra features for Phlox theme: from n/a through <= 2.17.15.

AnalysisAI

Authenticated users without proper authorization can modify content in the auxin-elements WordPress plugin (versions up to 2.17.15) due to missing access control checks on shortcode functionality. The vulnerability requires an authenticated account with low privileges and allows integrity compromise through shortcode manipulation, with an EPSS score of 0.04% indicating low real-world exploitation likelihood despite confirmed access control weakness.

Technical ContextAI

The auxin-elements plugin for the Phlox WordPress theme implements shortcode functionality that fails to properly validate user capabilities before allowing modifications. CWE-862 (Missing Authorization) indicates the plugin lacks proper access control enforcement on administrative or sensitive operations. The vulnerability exists in the shortcode processing logic where capability checks are either missing or incorrectly configured, allowing authenticated users with the PR:L (low privileges, such as contributor or author roles) to perform actions normally restricted to higher-privilege accounts. WordPress role-based access control relies on explicit capability checks via functions like current_user_can(), and this plugin fails to implement these checks consistently across its shortcode handlers.

Affected ProductsAI

The vulnerability affects Shortcodes and extra features for Phlox theme (auxin-elements) in all versions from the earliest tracked through and including version 2.17.15. The affected plugin is commonly identified by CPE patterns referencing WordPress plugins (CPE for WordPress plugins typically formatted as cpe:2.3:a:wordpress:auxin-elements). The Patchstack reference indicates the vulnerability was identified in version 2.17.12 and affects all versions up to the stated maximum of 2.17.15, suggesting recent plugin development was occurring at the time of discovery. Users running any version of auxin-elements at or below 2.17.15 are potentially affected.

RemediationAI

Users should immediately update the auxin-elements plugin to a version newer than 2.17.15; vendors typically release patched versions addressing CWE-862 authorization issues within minor or patch increments. Check the WordPress plugin repository or the vendor's release notes for the next available version following 2.17.15, which should contain proper capability checks via current_user_can() on all affected shortcode operations. As an interim mitigation, WordPress site administrators can restrict plugin access by limiting which user roles are allowed to create or edit posts/pages containing the affected shortcodes, and by enforcing strict user role policies to minimize the number of accounts holding contributor or author privileges. For detailed patch information and vulnerability specifics, refer to the Patchstack vulnerability database entry at https://patchstack.com/database/Wordpress/Plugin/auxin-elements/vulnerability/wordpress-shortcodes-and-extra-features-for-phlox-theme-plugin-2-17-12-broken-access-control-vulnerability.