What is the CVSS score of CVE-2026-25026?

CVE-2026-25026 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Team are affected by CVE-2026-25026?

Organizations using Missing Authorization vulnerability in RadiusTheme Team tlp-team face notable risk from CVE-2026-25026, a missing authorization vulnerability rated CVSS 7.5.

How to fix or mitigate CVE-2026-25026?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Monitor vendor channels for patch availability.

Team CVE-2026-25026

EUVD-2026-15623 HIGH

Missing Authorization (CWE-862)

2026-03-25 Patchstack

Authentication Bypass Team

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15623

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

HIGH 7.5

DescriptionCVE.org

Missing Authorization vulnerability in RadiusTheme Team tlp-team allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Team: from n/a through <= 5.0.11.

AnalysisAI

A missing authorization vulnerability exists in RadiusTheme Team plugin (versions up to 5.0.11) that allows attackers to exploit incorrectly configured access control security levels. This broken access control issue (CWE-862) enables unauthorized users to access or manipulate resources they should not have permission to access. The vulnerability affects the WordPress plugin tlp-team and has been documented by Patchstack as an authentication bypass vector, though no CVSS score, EPSS probability, or KEV status is currently available to assess active exploitation.

Technical ContextAI

The vulnerability is classified under CWE-862 (Missing Authorization), a root cause category describing situations where an application fails to verify that a user has proper permissions before granting access to sensitive functionality or resources. The affected product is the RadiusTheme Team WordPress plugin (CPE: cpe:2.3:a:radiustheme:team:*:*:*:*:*:*:*:*), which is a team collaboration or member management component commonly integrated into WordPress sites. The broken access control likely stems from missing or insufficient capability checks in WordPress hooks, filters, or REST API endpoints. WordPress plugins typically rely on the capabilities system (wp_capability checks, current_user_can() functions) to enforce authorization, and the misconfiguration suggests these checks are either absent, bypassable, or implemented at the wrong execution point, allowing unauthenticated or low-privilege users to perform administrative or privileged actions.

RemediationAI

Upgrade the RadiusTheme Team plugin to a version newer than 5.0.11 immediately; consult the vendor's security advisory and release notes on Patchstack or the RadiusTheme website for the specific patched version number and installation instructions. If an immediate patch is unavailable, implement server-side mitigation by restricting access to the WordPress admin dashboard and plugin functionality using IP whitelisting, Web Application Firewall (WAF) rules to block unauthorized API calls, and regular audits of user roles and capabilities to detect suspicious account activity. Additionally, ensure all WordPress core files, other plugins, and themes are kept up-to-date, enable WordPress security logging to monitor for authorization failures, and consider disabling the Team plugin entirely until a patch is available if the plugin is not critical to operations. The Patchstack reference (https://patchstack.com/database/Wordpress/Plugin/tlp-team/vulnerability/wordpress-team-plugin-5-0-11-broken-access-control-vulnerability?_s_id=cve) should be checked regularly for patch availability status and vendor guidance.