EUVD-2025-17225Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Matches provided vector; low privileges required, low integrity impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionCVE.org
Missing Authorization vulnerability in Akhtarujjaman Shuvo Post Grid Master allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Post Grid Master: from n/a through 3.4.13.
AnalysisAI
Broken access control in Post Grid Master 3.4.13 and earlier allows authenticated attackers with low privileges to modify unauthorized settings. The vulnerability is due to missing authorization checks, enabling exploitation of incorrectly configured access control security levels. No public exploit or active exploitation has been identified, and the EPSS score is low (0.06%).
Technical ContextAI
The vulnerability is a Missing Authorization (CWE-862) in the WordPress plugin Post Grid Master, which is used to create and manage post grids. The CPE indicates the plugin is installed on WordPress sites. The root cause is that the plugin fails to properly verify user permissions before allowing access to certain functionality, leading to unauthorized actions by authenticated users with low privileges.
RemediationAI
Update Post Grid Master to version 3.4.14 or later, as per the vendor advisory at https://patchstack.com/database/wordpress/plugin/ajax-filter-posts/vulnerability/wordpress-post-grid-master-3-4-13-broken-access-control-vulnerability?_s_id=cve. No workarounds are documented; restricting low-privileged user access to the plugin's settings may reduce risk but could impact functionality.
More in Post Grid Master
View allReflected cross-site scripting in Post Grid Master WordPress plugin versions up to 3.4.13 allows unauthenticated attacke
The Post Grid Master - Custom Post Types, Taxonomies & Ajax Filter Everything with Infinite Scroll, Load More, Paginatio
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AddonMaster Post G
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in AddonMaster
Missing Authorization vulnerability in AddonMaster Post Grid Master.4.7. Rated medium severity (CVSS 5.3), this vulnerab
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today