Wordpress Plugin
Monthly
Missing authorization in InstaWP Connect for WordPress up to version 0.1.1.9 allows unauthenticated attackers to modify and disrupt site content (low integrity and availability impact). The vulnerability stems from an incorrectly configured access control security level, leaving sensitive plugin functions exposed without proper capability checks. At the time of analysis, no evidence of active exploitation or public proof-of-concept exists, and EPSS indicates a low probability of widespread exploitation.
Unauthenticated information disclosure in LearnPress for WordPress up to version 4.2.9.4 enables remote attackers to read sensitive data by bypassing missing authorization checks. Exploitation requires no credentials or user interaction, but no public exploit or active exploitation has been identified. EPSS score of 0.05% indicates very low probability of real-world attacks.
Unauthorized data modification in WP Social Ninja WordPress plugin ≤ 3.20.1 allows remote unauthenticated attackers to alter plugin data or partially disrupt availability due to missing authorization checks on certain endpoints. The vulnerability carries a CVSS base score of 6.5 with low integrity and availability impact, and EPSS data predicts a very low exploitation probability (0.05%). No public exploit code or active exploitation has been identified at time of analysis.
Arbitrary file deletion in the Filr WordPress plugin (<=1.2.10) allows authenticated attackers to delete critical site files, causing a denial of service. No active exploitation or public exploit code has been reported, and EPSS indicates a low probability of widespread exploitation.
Content injection in the Stockie Extra WordPress plugin allows
Unauthenticated content deletion in MasterStudy LMS Pro WordPress plugin allows remote attackers to delete arbitrary learning content, causing complete availability loss. The vulnerability (CVE-2025-64214) affects versions up to 4.7.16, requires no authentication or user interaction
Reflected cross-site scripting (XSS) in 8theme's XStore Core WordPress plugin (versions below 5.6) allows unauthenticated remote attackers to inject arbitrary web scripts into pages generated by the plugin
Missing authorization in the WP Voting Contest WordPress plugin (versions ≤5.8) allows unauthenticated attackers to manipulate voting data without any prior authentication. The vulnerability carries a CVSS 7.5 but has a low EPSS score (0.06%), indicating limited observed exploitation activity as of analysis.
PHP object injection in PDF for Elementor Forms plugin through version 6.5.0 allows authenticated attackers to execute arbitrary code or manipulate application logic via deserialization of untrusted data. While CVSS scores this 8.8 (High), real-world risk is tempered by authentication requirement (PR:L) and low EPSS score (0.06%, 19th percentile), indicating minimal observed exploitation attempts. No CISA KEV listing or public exploit code identified, suggesting attacks remain theoretical rather than widespread.
Missing authorization controls in Parallax Section block ≤1.0.9 allow authenticated low-privileged WordPress users to access administrative functionality, leading to high impact on availability and low integrity impact with no data exposure. An attacker with a subscriber or contributor account can disrupt site availability and partially modify content without proper capability checks. Reported by Patchstack, this vulnerability carries a CVSS 7.1 but shows no evidence of active exploitation or public exploit code.
Local file inclusion in Task Manager WordPress plugin versions ≤3.0.2 enables authenticated attackers with low privileges to read arbitrary files from the web server through improper filename control in PHP include/require statements. Exploitation requires network access with high attack complexity. EPSS score of 0.06% (18th percentile) indicates low probability of mass exploitation. No active exploitation confirmed in CISA KEV at time of analysis, though Patchstack vulnerability database documents this as a disclosed LFI vulnerability.
Local file inclusion in Ray Enterprise Translation WordPress plugin through version 1.7.1 allows remote attackers to read arbitrary files on the server via path traversal in PHP include statements. Despite the moderate CVSS score of 7.5, the EPSS probability of 0.06% (20th percentile) indicates minimal observed exploitation activity in the wild. Patchstack has cataloged this vulnerability with proof-of-concept details, requiring attackers to overcome high complexity conditions and user interaction to achieve impact across confidentiality, integrity, and availability.
Local file inclusion in the Anchor smooth scroll WordPress plugin up to version 1.0.2 allows unauthenticated attackers to read arbitrary files from the server. This can expose sensitive data such as database credentials, and may be escalated to remote code execution under certain server conditions. No active exploitation has been confirmed, and a vendor fix is available.
Code injection in Javo Core WordPress plugin versions ≤3.0.0.266 allows an unauthenticated remote attacker to execute arbitrary code with high attack complexity, leading to limited confidentiality, integrity, and availability impact on the host system. No public exploit or active exploitation is confirmed, and EPSS score is very low (0.07%).
Unauthenticated SQL injection in the WordPress tPlayer plugin (HTML5 audio player with playlist) versions up to 1.2.1.6 allows remote attackers to extract sensitive data from the database via crafted requests, with limited availability impact. The vulnerability has a CVSS score of 9.3, requires no user interaction, and is classified as CWE-89. At the time of analysis, no public exploit code or active exploitation is known, and EPSS probability is low (0.06%).
Unauthenticated attackers can modify IDonatePro WordPress plugin data (integrity impact high) due to missing authorization checks in versions up to 2.1.9. Exploitation requires no privileges or user interaction and is carried out over the network. At the time of analysis, no active exploitation, public exploit code, or CISA KEV listing exists; EPSS score is low (0.07%).
Unauthenticated arbitrary content deletion in the Javo Core WordPress plugin up to version 3.0.0.529 can allow attackers to delete site content, causing a complete loss of data availability. The missing authorization vulnerability carries a CVSS 3.1 score of 7.5 with low EPSS exploitation probability, and no active exploitation or public proof-of-concept has been identified at the time of analysis.
Privilege escalation in e-plugins Hotel Listing plugin for WordPress (≤1.4.0) allows authenticated low-privileged attackers to gain administrator access. Successful exploitation could lead to full site compromise. No public exploit code or active exploitation has been confirmed; EPSS indicates low exploitation probability (0.08%).
Missing authorization in the Download After Email WordPress plugin versions 2.1.5 through 2.1.6 allows unauthenticated attackers to bypass access controls and access protected downloads intended for users who submit their email. The vulnerability has a CVSS base score of 5.8 (medium) but EPSS exploitation probability is very low (0.08%), and no public exploit or active exploitation has been reported.
Super Blank WordPress plugin versions up to 1.2.0 are vulnerable to missing authorization, allowing authenticated attackers with low privileges to delete arbitrary content. This can result in complete loss of site content availability; no active exploitation has been detected, and the EPSS likelihood is very low.
DigitalME eRoom eroom-zoom-meetings-webinar plugin through version 1.5.6 exposes sensitive data in sent communications due to improper data handling, allowing unauthenticated remote attackers with user interaction to retrieve embedded sensitive information across site boundaries. EPSS exploitation probability is low at 0.04%, but the vulnerability affects confidentiality, integrity, and availability through information disclosure mechanisms that may be chained with other flaws.
Information disclosure in VikBooking Hotel Booking Engine & PMS plugin for WordPress (versions n/a through 1.8.2) allows unauthenticated remote attackers to retrieve embedded sensitive data from HTTP responses. The insertion of sensitive information into sent data (CWE-201) can expose credentials, API keys, or other secrets, with a CVSS base score of 5.9 (AV:N/AC:H/PR:N/UI:N). No active exploitation or public exploit code is known at this time.
Unauthenticated modification of login page design in the Login Page Customizer WordPress plugin (<=2.1.1) allows remote attackers to alter the site's login and admin page customizations due to missing authorization checks. The vulnerability has low integrity and availability impact, and EPSS indicates very low exploitation probability with no known active exploitation or public exploit code.
Unauthenticated missing authorization in The African Boss Get Cash WordPress plugin up to 3.2.3 allows remote attackers to modify plugin data and potentially disrupt cash-related functionality without any prior access. The vulnerability carries a Medium severity with low EPSS exploitation likelihood, and no active exploitation or public PoC has been reported.
Blind SQL injection in the PopupKit WordPress plugin through version 2.1.5 allows authenticated attackers with low privileges to extract sensitive database information without user interaction. The vulnerability, assigned CWE-89, has a high CVSS score but a very low EPSS probability (0.05%), and no known public exploits or active exploitation have been identified at this time.
Authorization bypass in the Contact Form Email plugin for WordPress (versions <= 1.3.60) enables unauthenticated attackers to modify or remove contact form entries by manipulating user-controlled key values, with no confidentiality impact. No user interaction required, and the vulnerability is exploitable remotely, though EPSS indicates a low probability of widespread exploitation.
Authenticated users with limited privileges can modify plugin settings and access functionality they should not have access to via missing authorization checks in Buttoner for Elementor through version 1.0.6. The vulnerability requires valid WordPress user credentials but no administrative role, allowing privilege escalation within the plugin's configuration interface. EPSS score of 0.05% indicates low exploitation probability despite network accessibility.
Broken access controls in Ultimate Auction plugin for WordPress up to version 4.3.3 allow low-privileged attackers to modify or disrupt auction operations. The missing authorization checks (CWE-862) enable unauthorized changes without user interaction, impacting integrity and availability but not confidentiality. No active exploitation or public exploit code has been reported; EPSS indicates a low exploitation probability.
Cross-site request forgery in the Meks Quick Plugin Disabler WordPress plugin (≤1.0) allows an attacker to trick a logged-in administrator into disabling plugins, leading to potential service disruption. No active exploitation or public exploit code is known; EPSS probability is 0.03%.
Cross-Site Request Forgery in the Semrush Content Toolkit WordPress plugin allows attackers to trick authenticated users into performing unauthorized actions. All versions up to 1.1.32 are vulnerable. No active exploitation or public exploit code has been reported, and EPSS score indicates very low likelihood of widespread exploitation.
Stored cross-site scripting (XSS) in ThemeNectar Salient Shortcodes WordPress plugin through version 1.5.4 allows authenticated users with low privileges to inject malicious scripts that execute in the context of higher-privileged administrators or other site visitors. The vulnerability requires user interaction (UI:R in CVSS vector) and affects the shortcode generation functionality, enabling persistence of malicious payloads in page content. EPSS score of 0.06% indicates low real-world exploitation probability despite the moderate CVSS 6.5 rating.
Authorization bypass in Essential Real Estate WordPress plugin versions through 5.2.9 allows authenticated users to access sensitive real estate data they should not have permission to view through user-controlled key manipulation. The vulnerability exploits incorrectly configured access control at the application level, enabling privilege escalation from a standard user account to view confidential information such as property details or pricing. No public exploit code has been identified, and the EPSS score of 0.04% indicates low exploitation probability despite the CVSS 6.5 severity rating.
Local file inclusion in the Stockholm Core WordPress plugin (≤2.4.6) allows authenticated users with low privileges to include arbitrary local files, potentially leading to sensitive data exposure or remote code execution. No active exploitation or public exploit code is known at this time, though the low EPSS score indicates limited real-world risk despite the high CVSS impact.
Local File Inclusion in the Hub Core WordPress plugin (LiquidThemes, versions through 5.0.8) allows an authenticated network attacker with low privileges to supply a crafted filename parameter that is passed unsanitized to a PHP include/require statement, enabling inclusion of arbitrary server-side files. Successful exploitation can expose sensitive configuration data (wp-config.php, credentials) or, under favorable server conditions such as log poisoning, escalate to remote code execution and full site compromise. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; EPSS sits at 0.08%, reflecting low current exploitation activity.
SQL injection in LBG Zoominoutslider WordPress plugin versions through 5.4.4 allows authenticated attackers with low-level privileges to extract sensitive database information and potentially cause denial of service. The vulnerability enables cross-scope impact, meaning attackers can access resources beyond their authorized privilege level. EPSS probability is low (0.04%, 14th percentile), indicating limited observed exploitation activity, though Patchstack's disclosure suggests active security community awareness.
SQL injection in Themefic Hydra Booking for WordPress allows authenticated attackers to read sensitive database contents. The vulnerability affects versions up to 1.1.32 and is reachable over the network with low-privilege access. No public exploit is known and EPSS indicates low exploitation probability.
Blind SQL injection vulnerability in the LambertGroup CountDown With Image or Video Background WordPress plugin (versions up to 1.5) allows authenticated users with minimal privileges (e.g., subscriber) to extract sensitive database information. No active exploitation or public exploit code is known at this time, and EPSS indicates a very low probability of real‑world attacks.
Blind SQL injection in the xPromoter top_bar_promoter WordPress plugin versions up to 1.3.4 permits authenticated attackers with low privileges to extract sensitive data from the database. Exploitation requires sending crafted requests to a vulnerable plugin endpoint, potentially exposing user credentials and configuration details. No public exploit code or active exploitation has been reported, and EPSS score indicates a low probability of widespread attacks.
Blind SQL injection in the Newsletter plugin for WordPress up to
DOM-based cross-site scripting in the Document Library Lite WordPress plugin (versions <=1.1.7) allows authenticated attackers with high privileges to execute arbitrary JavaScript in the browser of an administrator who visits a crafted page. This could lead to account compromise or malicious actions within the WordPress admin.
Insecure direct object reference in Barn2 Document Library Lite plugin for WordPress allows unauthenticated remote attackers to read arbitrary documents by manipulating a user-controlled key parameter. Affected versions include all releases up to and including 1.1.7, with low confidentiality impact and no integrity or availability loss.
Remote unauthenticated attackers can exploit missing authorization checks in the Homey Core plugin (versions ≤ 2.4.3) to degrade service availability. The vulnerability stems from a missing authorization flaw (CWE-862) that permits unauthorized interaction with vulnerable endpoints. No public exploit code has been identified and active exploitation is not confirmed at the time of analysis.
SQL injection vulnerability in the Broken Link Checker SEO WordPress plugin up to version 1.2.6 allows authenticated administrators to execute arbitrary SQL commands, potentially exposing sensitive information from the database. The flaw, tracked as CVE-2025-67962, carries a CVSS 3.1 base score of 7.6 from Patchstack but is limited to high-privileged users, and no public exploit code or active exploitation (KEV) has been observed. The low EPSS score of 0.06% further suggests minimal real-world exploitation probability at this time.
Blind SQL injection in the All In One SEO Pack WordPress plugin through version 4.9.1 allows authenticated attackers with subscriber-level access to execute arbitrary SQL queries, potentially extracting sensitive database contents.
Missing authorization in NinjaTeam FileBird Pro WordPress plugin versions up to 6.5.1 allows authenticated users to access and modify files they should not have permission to view or edit due to incorrectly configured access control security levels. The vulnerability requires valid user credentials but can lead to disclosure and modification of sensitive files within the plugin's file management interface. EPSS exploitation probability is low at 0.04%, and no public exploit code has been identified at the time of analysis.
Missing authorization in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin versions up to 4.0.7 allows unauthenticated attackers to modify cookie consent settings, potentially undermining the site’s compliance posture. No active exploitation or public proof-of-concept has been identified, and the EPSS score (0.05%) indicates very low exploitation probability.
Authorization bypass in FAPI Member WordPress plugin through version 2.2.29 allows unauthenticated remote attackers to access or modify resources via insecure direct object references (IDOR) exploiting misconfigured access control security levels. The vulnerability requires no authentication, low attack complexity, and results in confidentiality and integrity impact without availability compromise. EPSS score of 0.04% indicates minimal real-world exploitation probability despite the moderate CVSS score.
Broken access control in Yaad Sarig Payment Gateway for WooCommerce (versions ≤2.2.11) allows unauthenticated remote attackers to bypass authorization checks and gain unauthorized access to payment gateway functions. With CVSS 9.1 (Critical) scoring reflecting network-accessible exploitation requiring no privileges or user interaction, attackers can read or modify sensitive payment data. EPSS score of 0.04% (14th percentile) suggests low observed exploitation probability despite severity. No public exploit identified at time of analysis, though the authentication bypass tag indicates potential for unauthorized transaction manipulation or data exposure in WordPress e-commerce environments.
Missing authorization in g5theme Essential Real Estate WordPress plugin version 5.2.9 and earlier allows authenticated users to access or modify restricted resources by exploiting inadequately configured access controls. An attacker with low-privilege WordPress account credentials can leverage the broken access control to view sensitive information and make unauthorized modifications without requiring administrative approval. No public exploit code is currently identified, though the vulnerability is documented in the Patchstack security database.
Information disclosure in wowpress.host Fix Media Library up to version 2.0 allows unauthenticated attackers to retrieve sensitive data embedded in sent data. The vulnerability, disclosed by Patchstack, has a CVSS 5.3 (medium) and a low EPSS exploitation probability (0.05%), with no known public exploits at this time.
Sensitive information disclosure in WordPress Ultimate Auction plugin up to version 4.3.3 allows unauthenticated remote attackers to retrieve embedded sensitive data from the application's responses. No authentication is required, making exploitation simple with only network access needed. Current threat intelligence indicates a very low risk of exploitation, with no active attacks observed.
Unauthenticated remote attackers can bypass access controls in ZEEN101 Leaky Paywall WordPress plugin versions up to 4.22.6, gaining unauthorized access to restricted content through incorrectly configured security levels. The vulnerability requires no user interaction and can be exploited over the network, though it is limited to information disclosure (CVSS 5.3, EPSS 0.04%). No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated access to a sensitive function in the Stylish Price List WordPress plugin through version 7.2.2 allows remote attackers to degrade service availability. The missing authorization check can be leveraged to perform actions that impact the plugin's availability without requiring login credentials. No active exploitation or public exploit code has been identified.
Missing authorization in the SiteGround Security plugin for WordPress (≤1.5.8) allows unauthenticated remote attackers to trigger availability disruptions by exploiting incorrectly configured access controls. The vulnerability has a CVSS 5.3 (Medium) but EPSS scores only 0.05%, indicating minimal predicted exploitation; no active attacks or public exploit code have been observed.
Unauthenticated information disclosure in the CatFolders WordPress plugin up to version 2.5.3 allows remote attackers to access restricted data via a missing authorization check. No public exploit is known, and EPSS indicates a low exploitation probability (0.05%).
Missing authorization in WP Compress for MainWP plugin versions up to 6.50.17 allows unauthenticated remote attackers to modify plugin settings due to incorrectly configured access control, affecting integrity of compressed content and plugin configuration without requiring authentication or user interaction.
Unauthenticated modification of plugin data affects Feeds for YouTube plugin for WordPress through version 2.4.0. The vulnerability stems from a missing authorization check, allowing remote attackers to alter settings without authentication. Despite a CVSS base score of 5.3, only low integrity impact is possible, and no active exploitation or public proof-of-concept has been identified at the time of analysis.
Unauthenticated remote attackers can access sensitive sitemap data in Google XML Sitemaps WordPress plugin versions through 4.1.22 due to missing authorization checks on sitemap endpoints. The vulnerability allows unauthorized information disclosure of site structure and indexed pages without requiring authentication or user interaction. While the CVSS score is moderate (5.3), real-world exploitation probability is very low (EPSS 0.04th percentile), suggesting this is primarily an information disclosure risk rather than an active threat.
WCFM Marketplace plugin through version 3.7.1 fails to properly enforce authorization controls, allowing authenticated users with limited privileges to cause denial of service or access functionality they should not have. The vulnerability affects the WordPress plugin across all installations through the specified version, exploiting incorrectly configured access control security levels via network-accessible endpoints. With an EPSS score of 0.05% and low real-world exploitation probability, this represents a privilege escalation risk primarily for multi-vendor marketplace administrators.
Denial-of-service vulnerability in Strategy11’s Business Directory Plugin for WordPress (≤ 6.4.19) allows authenticated high-privileged attackers to disrupt site availability. The flaw stems from missing authorization checks, permitting an admin-level user to trigger an action with high availability impact. No public exploit is known, and EPSS (0.06%) indicates low exploitation probability despite the network-based attack vector.
Arbitrary content deletion in WordPress Ultimate Learning Pro plugin versions <= 3.9.3 allows authenticated high-privilege users to delete learning content without proper authorization checks. An attacker with instructor or administrator access can delete arbitrary posts, lessons, or courses, resulting in high integrity impact but no data theft or system disruption. The vulnerability is not known to be actively exploited and has very low exploitation likelihood (EPSS 0.05%).
Open redirect vulnerability in wpWax Directorist WordPress plugin versions up to 8.6.6 allows unauthenticated remote attackers to redirect users to arbitrary external websites via crafted URL parameters, enabling phishing attacks. The vulnerability requires user interaction (clicking a malicious link) but has a network attack vector with low complexity. EPSS exploitation probability is very low at 0.04%, and no active exploitation or public proof-of-concept has been identified.
Denial of service in WordPress Protect WP Admin plugin <=4.1 allows unauthenticated remote attackers to degrade availability. A missing authorization check enables exploitation of incorrectly configured access control security levels, causing a low-impact loss of availability without affecting confidentiality or integrity. The vulnerability has a low EPSS score (0.05%) and no known public exploit or active exploitation.
Missing authorization in the WordPress Read More & Accordion plugin (expand-maker) versions 3.5.5.1 and earlier allows authenticated users to access restricted functionality through incorrectly configured access controls, potentially revealing sensitive information. The vulnerability requires user authentication and network access but carries a CVSS score of 6.5 due to high confidentiality impact, though real-world exploitation probability remains low at 0.04% EPSS. No public exploit code or active exploitation has been identified at time of analysis.
Authenticated low-privileged users can exploit missing authorization in the Accessibility by AudioEye WordPress plugin (≤1.0.49) to modify plugin data, resulting in a limited integrity impact. The vulnerability allows attackers with subscriber roles to bypass access controls on plugin endpoints, though no active exploitation or public exploit code is currently known. The CVSS score of 4.3 reflects its low severity.
Unauthorized access to attachment management exists in the Import external attachments WordPress plugin, allowing low-privileged users to modify external attachment settings or data without proper authorization checks. Versions up to 1.5.12 are vulnerable, and remote attackers with subscriber-level or similar accounts can exploit this missing authorization (CWE-862). No active exploitation or public proof-of-concept code is reported at the time of analysis, and EPSS indicates a low exploitation probability (0.05%).
Unauthorized modification of Elementor widget restrictions in the Restrict Elementor Widgets plugin for WordPress allows authenticated users with low privileges to bypass access controls. Affecting versions up to and including 1.12, this missing authorization flaw can be exploited to alter widget, column, and section restrictions without proper permissions. No active exploitation is confirmed, and the EPSS score remains low at 0.05%.
Low-privileged authenticated users of the e-plugins Directory Pro WordPress plugin (<=2.5.6) can bypass access controls due to a missing authorization flaw, potentially modifying plugin data. The vulnerability has a medium CVSS score (4.3) with low integrity impact, and no active exploitation or public exploit has been reported; EPSS score of 0.05% indicates a low probability of in-the-wild attacks.
Inadequately configured access control in Easy Property Listings WordPress plugin versions 3.5.21 and earlier allows authenticated users to access sensitive information they should not be authorized to view. An authenticated attacker with user-level privileges can bypass authorization checks to read property listing data or other restricted content due to missing authorization validation on API endpoints or functionality. EPSS exploitation probability is very low at 0.04%, and no public exploit code has been identified, indicating limited real-world threat despite the authentication-bypass tag.
Authenticated attackers with low-level privileges can modify plugin data in the WP Coupons and Deals WordPress plugin through version 3.2.4 due to missing authorization checks. This integrity-only impact (CVSS 4.3) requires an already-authorized low-privilege user account, limiting risk. No active exploitation has been reported, and the EPSS probability is 0.05% (14th percentile), indicating very low exploitation likelihood.
Cross-site request forgery in the RTL Tester WordPress plugin through version 1.2 allows unauthenticated attackers to trick administrative users into toggling the RTL test mode, causing temporary site layout changes. This low-severity issue (CVSS 4.3) has a very low exploitation probability (EPSS 0.03%) and no known active exploitation or public exploit code.
Authenticated low-privilege attackers can bypass access controls in the WPS Bidouille WordPress plugin through version 1.33.1, allowing unauthorized modification of plugin data. The vulnerability has a low EPSS score (0.05%) and no public exploit or active exploitation is currently reported.
Cross-site request forgery in the Quick Interest Slider WordPress plugin (versions up to 3.1.5) allows unauthenticated attackers to deceive authenticated administrators into executing unauthorized actions, such as modifying plugin settings. No public exploit code or active exploitation has been identified, and EPSS predicts a very low exploitation probability.
We are tasked to synthesize data from multiple intelligence sources about CVE-2025-59001 into a comprehensive analysis, returning a JSON object with specific fields. We need to cross-reference the data, provide original synthesis, and adhere to strict rules. Input data: - CVE ID: CVE-2025-59001 - Description: "Missing Authorization vulnerability in ThemeNectar Salient Core salient-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Salient Core: from n/a through <= 3.0.8." - CVSS Score: 4.3 - CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - CWE: CWE-862 (Missing Authorization) - EPSS Score: 0.05% (percentile 16%) - Reported by: audit@patchstack.com - Tags: Authentication Bypass (Note: tags might be from Patchstack, but we'll incorporate) - References: [nvd] (None) but actually a Patchstack URL: https://patchstack.com/database/Wordpress/Plugin/salient-core/vulnerability/wordpress-salient-core-plugin-3-0-8-broken-access-control-vulnerability?_s_id=cve - Also, there is no KEV status provided, no POC status mentioned. We must not assume KEV. Our exploitation status phrase: no public exploit identified at time of analysis (since no KEV, no POC stated). But wait, Patchstack might have reported, but we have no explicit "POC=YES" in the data. So we'll use that phrase. We need to fill fields: 1. product_name: "1-3 words ONLY. The specific product or service name affected." It's "Salient Core". That's a WordPress plugin by ThemeNectar. So "Salient Core" works. 2. summary: "2-3 sentence plain-language summary for security professionals. CRITICAL: Do NOT copy or paraphrase the Description — write an original synthesis using all available data. Do NOT start with 'A vulnerability', 'A problem', 'A flaw', or 'An issue'. Start with the specific impact verb and product, e.g. 'Remote code execution in Apache Tomcat 9.x allows...' or 'Cortex XDR agent on macOS can be disabled by local admins via...'. Explain WHAT the vulnerability is, WHO is affected (specific product/version), and WHAT an attacker can do. Mention if actively exploited (KEV), if POC exists, and EPSS risk if notable." So, missing authorization in Salient Core plugin <=3.0.8 allows authenticated users to exploit incorrectly configured access control to modify some data (I:L, integrity impact low, no confidentiality or availability). No active exploitation known, and EPSS is low (0.05%). So summary: "Authenticated attackers can exploit a missing authorization check in ThemeNectar Salient Core plugin versions through 3.0.8 to modify data without proper permissions. The vulnerability results from incorrectly configured access control security levels, with low integrity impact and no confidentiality or availability impact. EPSS probability is very low (0.05%), and no public exploit code or active exploitation has been identified at this time." That's original. 3. technical_context: "Explain the underlying technology/library/protocol involved. Use CPE data to identify exact affected products. Reference the CWE to explain the root cause class. Be specific and educational." No CPE data provided, so we can mention that CPE is not available, but the product is a WordPress plugin. We can talk about missing authorization (CWE-862) and how access control in WordPress plugins can be misconfigured. Also, the Patchstack link likely provides details. We'll say: "The Salient Core plugin for WordPress is affected by a missing authorization vulnerability (CWE-862). This class of weakness occurs when a web application does not properly restrict access to privileged functionality, allowing low-privileged authenticated users to perform actions that should require higher permissions. The vulnerability is in the plugin's access control mechanisms, which fail to enforce correct security levels. No CPE information is provided, but the vendor's plugin is available on WordPress.org or ThemeNectar's site." 4. risk_assessment: "Assess real-world risk using ALL available signals: CVSS vector (attack vector, complexity, privileges), EPSS exploitation probability, KEV status, POC availability, SSVC decision framework (exploitation status, automatable, technical impact). Compare and contrast these signals. Is this a real priority or just a high-CVSS-but-low-real-risk issue? If any key data is missing or conflicting, STATE IT EXPLICITLY, e.g.: 'CVSS indicates network vector but description implies local access — verify with vendor.' or 'EPSS score is low despite KEV listing, suggesting targeted rather than widespread exploitation.' Do NOT present uncertain information as confirmed fact." So here: CVSS 4.3, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. It's network exploitable, low complexity, low privileges required (authenticated, any user), no user interaction, unchanged scope, only integrity low impact. EPSS 0.05% (very low). No KEV, no POC. SSVC: exploitation=none (no public exploit), automatable=maybe (AC:L, but needs authentication, so perhaps not fully automatable without credentials), technical impact=partial (integrity modification). So risk is low. We'll say: "The CVSS score is low (4.3) due to limited impact, but the vector indicates an authenticated remote attack with low complexity. EPSS probability of exploitation is negligible (0.05%, percentile 16%), and there is no evidence of active exploitation or public exploit code. This vulnerability does not appear to be a high-priority threat, as it requires authentication and only allows integrity modification, not compromising confidential data or system availability. The missing authorization likely stems from a configuration specific to the plugin's access control levels, so risk is contextual." A note: no data conflicts; CVSS aligns with description. 5. affected_products: "Write a concise paragraph listing affected products with their versions. Include product name, version range, CPE if available, and link to vendor advisory from references. Do NOT use bullet points, JSON, or key-value formatting." So: "ThemeNectar Salient Core plugin for WordPress, versions from n/a through 3.0.8, are affected. The vendor advisory is available at https://patchstack.com/database/Wordpress/Plugin/salient-core/vulnerability/wordpress-salient-core-plugin-3-0-8-broken-access-control-vulnerability?_s_id=cve." (Use the reference link). No CPE mentioned, so skip that. 6. remediation: "Write a concise paragraph with actionable remediation steps. Start with the primary fix (patch/upgrade with exact version), then mention workarounds if relevant. Include advisory URLs from references. If no patch is available, suggest SPECIFIC compensating controls with their trade-offs — not generic 'apply defense in depth' but actionable: 'Disable X feature', 'Block Y port', 'Restrict access to Z endpoint'. Note side effects of each mitigation. Do NOT use bullet points, JSON, or key-value formatting." The description says "from n/a through <= 3.0.8", implying that version 3.0.8 is the highest affected, and presumably fixed in version above that, but no specific fix version is given. Patchstack advisory may have details. Since we only have the link, we can check if it says "Fixed in version: 3.0.9" or something. But we don't have that info from the input, just the URL. I can't access it, so I'll assume there is a patch. The data says "Missing Authorization vulnerability... This issue affects Salient Core: from n/a through <= 3.0.8." Typically, Patchstack entries include a fixed version. But in this input, no fix version explicitly. I'll phrase: "Upgrade Salient Core to a version newer than 3.0.8. The vendor has not explicitly announced a fixed version in the CVE data, but the advisory at Patchstack likely provides details. As a workaround, administrators can restrict access to the affected plugin's functionality by reviewing and hardening access control settings until an update is applied, though this may require manual configuration review." But we must not invent version numbers. If no patch is known, I will state that. However, given the structure, I'll say "Update to a patched version beyond 3.0.8" – but that is an inference. Better: "The advisory at Patchstack (see reference) indicates the vulnerability affects versions up to 3.0.8; update to the latest version, which should contain the fix. If no patch is yet available, restrict access to authenticated users with necessary roles, or disable the plugin temporarily. Disabling the plugin may affect functionality dependent on Salient Core." I'll incorporate the reference. 7. exploit_scenario: "Brief realistic attack scenario in 2-3 sentences. If POC exists, note that. Factor in attack vector and complexity from CVSS." No POC exists. Attack scenario: "An authenticated low-privileged user, such as a subscriber on a WordPress site, crafts a request to a Salient Core endpoint that lacks proper authorization checks. Due to missing access control, the user modifies settings or content they should not have permission to alter, leading to unauthorized data modification." This matches AV:N, PR:L, UI:N, I:L. 8. exploitation_conditions: "CRITICAL FIELD — security teams make real decisions based on this. Extract SPECIFIC, CONCRETE prerequisites from the CVE description. Name the EXACT product feature, protocol, configuration setting, or deployment mode required. If the description says 'when configured with...' or 'if the X feature is enabled' — that IS the condition. If genuinely no special conditions (AV:N/AC:L/PR:N/UI:N), state: 'No special conditions — remote unauthenticated exploitation against default configurations of [PRODUCT NAME].' Also state what LIMITS exploitation: required user interaction, authentication level, non-default configuration, specific platform/version. These limiting factors help defenders assess realistic risk beyond raw CVSS score. FORBIDDEN generic phrases: 'Network access required.' / 'Specific configuration needed.' / 'Depends on deployment.'" From the description: "Missing Authorization vulnerability ... allows Exploiting Incorrectly Configured Access Control Security Levels." This implies that the vulnerability is due to incorrectly configured access control security levels. So the condition might be that access control security levels are not correctly configured. However, the CVSS vector has PR:L, so it requires authentication with low privileges. So specific conditions: "Exploitation requires an authenticated user with low privileges (e.g., subscriber) on a WordPress site where the Salient Core plugin is active. The vulnerability manifests when access control security levels are misconfigured, potentially due to the plugin's default settings. No user interaction is required. No other special conditions; the attack vector is network-based, and complexity is low." That's specific enough. The "incorrectly configured" might be inherent to the plugin's code rather than a site-specific misconfiguration, but it's a missing authorization check. So I'll phrase: "Exploitation requires an authenticated low-privilege user account on a WordPress instance running Salient Core 3.0.8 or earlier. The vulnerability exists in the plugin's access control mechanisms, specifically when handling requests to certain endpoints where permissions are not properly enforced. No other prerequisites such as enabled features or non-default settings are needed, but the attacker must have valid credentials." 9. attack_chain: "3-7 short steps separated by ' → ' (arrow), following kill chain phases. Use as many steps as the attack realistically requires. Each step is 3-8 words. Must be grounded in actual CVE data (attack vector, privileges, scope from CVSS). Phase templates by length: 3-step: Access → Exploit → Impact. 4-step: Access → Exploit → Execution → Impact. 5-step: Access → Delivery → Exploit → Execution → Impact. 6-step: Access → Delivery → Exploit → Execution → Persist → Impact. 7-step: Recon → Delivery → Exploit → Install → C2 → Execute → Impact. Example: 'Send crafted HTTP request → Trigger buffer overflow in parser → Execute arbitrary code as root'. No numbering, no prose, just the chain." So: Access: "Authenticate with low-privilege user account" -> Exploit: "Send request to unprotected endpoint" (or "Craft request to bypass authorization") -> Impact: "Modify data without proper authorization". That's 3 steps: "Authenticate as low-privileged user → Send crafted request to missing-auth endpoint → Unauthorized data modification". Alternatively, could be 4 steps: Access -> Delivery (sending the request) -> Exploit (the missing check allows access) -> Impact. But 3 steps suffices: "Access: obtain low-privilege credentials" → "Exploit: invoke
Authenticated users with limited privileges can access search and replace functionality in CM On Demand Search And Replace WordPress plugin (versions up to 1.5.5) due to missing authorization checks on restricted features. An attacker with basic user credentials can perform privileged actions intended only for administrators, affecting data confidentiality through unauthorized content access. This is confirmed as an authentication bypass vulnerability with low real-world exploitation probability (EPSS 0.04%) despite the missing authorization flaw.
Missing authorization in the SKT Page Builder WordPress plugin allows authenticated attackers to modify page content. The vulnerability permits low-privilege users (e.g., subscribers) to perform unauthorized actions due to incorrectly configured access control security levels. No public exploit or active exploitation is confirmed, but the low privilege requirement poses a moderate insider threat risk.
Missing Authorization vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.3.0. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cross-Site Request Forgery in PSM Plugins SupportCandy allows remote attackers to perform unintended actions in the WordPress plugin by tricking a logged-in administrator into visiting a malicious link. This vulnerability affects SupportCandy versions up to and including 3.4.1. No exploitation or public proof-of-concept is known, and the EPSS probability is extremely low at 0.03%.
Missing authorization in Fluent Booking WordPress plugin through version 1.9.11 allows authenticated low-privileged users to modify data without proper access controls. This integrity-only flaw can lead to unauthorized changes in booking information on affected sites.
Cross-Site Request Forgery in Strategy11 Team Business Directory plugin allows attackers to perform unauthorized actions on behalf of authenticated administrators. Affecting installations up to version 6.4.19, this flaw can be triggered when a logged-in user visits a malicious website. No active exploitation or public exploit code is known, and EPSS indicates a very low likelihood of widespread attacks.
Cross-Site Request Forgery in the Quiz Maker WordPress plugin by Ays Pro up to version 6.7.0.82 allows unauthenticated attackers to perform unauthorized actions on behalf of authenticated site administrators. No active exploitation or public exploit code has been identified, and a vendor patch is available via a later version.
Authorization bypass through user-controlled key in ThimPress Thim Elementor Kit plugin up to version 1.3.3 allows authenticated attackers to modify data via insecure direct object references. The vulnerability has a CVSS base score of 4.3, a low EPSS exploitation probability (0.07%), and no known public exploit or active exploitation.
Cross-Site Request Forgery (CSRF) in the UsersWP WordPress plugin up to 1.2.48 allows unauthenticated attackers to perform low-integrity actions by tricking an authenticated user into clicking a crafted link. Only the integrity of the targeted user’s data is affected, with no risk to confidentiality or availability. No active exploitation or public exploit code has been identified.
Authenticated low-privilege users can modify calendar data in My Calendar WordPress plugin versions <= 3.6.16 due to missing authorization checks, allowing unauthorized integrity impact. The flaw has a CVSS score of 4.3, very low exploitation probability (EPSS 0.05%), and no known active exploitation or public exploit code at time of analysis.
Cross-site request forgery (CSRF) in the JNews Paywall WordPress plugin (versions < 12.0.1) allows remote attackers to trick logged-in administrators into performing unintended actions, such as modifying plugin settings, by inducing them to click a malicious link. The vulnerability carries a CVSS base score of 4.3 (Medium) and an EPSS probability of 0.03%, indicating very low anticipated exploitation rates. No public exploit or active exploitation is currently reported.
Cross-site request forgery in the Ultimate FAQ WordPress plugin through version 2.4.3 allows unauthenticated attackers to trick authenticated administrators into performing unintended actions, such as modifying FAQ content. The vulnerability carries a CVSS 4.3 (medium) and a very low EPSS exploitation probability (0.03%), with no evidence of active exploitation or public proof-of-concept at time of analysis.
Missing authorization checks in Elementor Website Builder (WordPress plugin) through version 3.33.0 allow authenticated low-privilege users to perform actions beyond their intended access level. Exploitation requires a valid WordPress account with low privileges (PR:L per CVSS vector), and the impact is limited to partial integrity modification with no confidentiality or availability consequences. No public exploit code or active exploitation has been identified; EPSS places this at the 14th percentile, reflecting low real-world exploitation probability.
Open redirect in CRM Perks WP Gravity Forms FreshDesk Plugin up to 1.3.5 allows unauthenticated attackers to craft URLs that redirect users to arbitrary untrusted sites, facilitating phishing attacks. The vulnerability has no known active exploitation or public exploit, and EPSS indicates a very low exploitation probability.
The Highlight and Share WordPress plugin up to version 5.2.0 contains a missing authorization vulnerability that allows unauthenticated attackers to bypass access controls. Exploitation requires user interaction and can lead to unauthorized modification of plugin settings or limited information disclosure. Publicly available exploit code exists, but the vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities catalog.
Missing authorization controls in IDonate WordPress plugin through version 2.1.15 allows unauthenticated remote attackers to access sensitive information due to incorrectly configured access control security levels. The vulnerability has a low EPSS score (0.04%, 13th percentile) and no public exploit code or active exploitation is documented, indicating limited real-world attack incentive despite network-accessible attack surface.
Missing authorization in InstaWP Connect for WordPress up to version 0.1.1.9 allows unauthenticated attackers to modify and disrupt site content (low integrity and availability impact). The vulnerability stems from an incorrectly configured access control security level, leaving sensitive plugin functions exposed without proper capability checks. At the time of analysis, no evidence of active exploitation or public proof-of-concept exists, and EPSS indicates a low probability of widespread exploitation.
Unauthenticated information disclosure in LearnPress for WordPress up to version 4.2.9.4 enables remote attackers to read sensitive data by bypassing missing authorization checks. Exploitation requires no credentials or user interaction, but no public exploit or active exploitation has been identified. EPSS score of 0.05% indicates very low probability of real-world attacks.
Unauthorized data modification in WP Social Ninja WordPress plugin ≤ 3.20.1 allows remote unauthenticated attackers to alter plugin data or partially disrupt availability due to missing authorization checks on certain endpoints. The vulnerability carries a CVSS base score of 6.5 with low integrity and availability impact, and EPSS data predicts a very low exploitation probability (0.05%). No public exploit code or active exploitation has been identified at time of analysis.
Arbitrary file deletion in the Filr WordPress plugin (<=1.2.10) allows authenticated attackers to delete critical site files, causing a denial of service. No active exploitation or public exploit code has been reported, and EPSS indicates a low probability of widespread exploitation.
Content injection in the Stockie Extra WordPress plugin allows
Unauthenticated content deletion in MasterStudy LMS Pro WordPress plugin allows remote attackers to delete arbitrary learning content, causing complete availability loss. The vulnerability (CVE-2025-64214) affects versions up to 4.7.16, requires no authentication or user interaction
Reflected cross-site scripting (XSS) in 8theme's XStore Core WordPress plugin (versions below 5.6) allows unauthenticated remote attackers to inject arbitrary web scripts into pages generated by the plugin
Missing authorization in the WP Voting Contest WordPress plugin (versions ≤5.8) allows unauthenticated attackers to manipulate voting data without any prior authentication. The vulnerability carries a CVSS 7.5 but has a low EPSS score (0.06%), indicating limited observed exploitation activity as of analysis.
PHP object injection in PDF for Elementor Forms plugin through version 6.5.0 allows authenticated attackers to execute arbitrary code or manipulate application logic via deserialization of untrusted data. While CVSS scores this 8.8 (High), real-world risk is tempered by authentication requirement (PR:L) and low EPSS score (0.06%, 19th percentile), indicating minimal observed exploitation attempts. No CISA KEV listing or public exploit code identified, suggesting attacks remain theoretical rather than widespread.
Missing authorization controls in Parallax Section block ≤1.0.9 allow authenticated low-privileged WordPress users to access administrative functionality, leading to high impact on availability and low integrity impact with no data exposure. An attacker with a subscriber or contributor account can disrupt site availability and partially modify content without proper capability checks. Reported by Patchstack, this vulnerability carries a CVSS 7.1 but shows no evidence of active exploitation or public exploit code.
Local file inclusion in Task Manager WordPress plugin versions ≤3.0.2 enables authenticated attackers with low privileges to read arbitrary files from the web server through improper filename control in PHP include/require statements. Exploitation requires network access with high attack complexity. EPSS score of 0.06% (18th percentile) indicates low probability of mass exploitation. No active exploitation confirmed in CISA KEV at time of analysis, though Patchstack vulnerability database documents this as a disclosed LFI vulnerability.
Local file inclusion in Ray Enterprise Translation WordPress plugin through version 1.7.1 allows remote attackers to read arbitrary files on the server via path traversal in PHP include statements. Despite the moderate CVSS score of 7.5, the EPSS probability of 0.06% (20th percentile) indicates minimal observed exploitation activity in the wild. Patchstack has cataloged this vulnerability with proof-of-concept details, requiring attackers to overcome high complexity conditions and user interaction to achieve impact across confidentiality, integrity, and availability.
Local file inclusion in the Anchor smooth scroll WordPress plugin up to version 1.0.2 allows unauthenticated attackers to read arbitrary files from the server. This can expose sensitive data such as database credentials, and may be escalated to remote code execution under certain server conditions. No active exploitation has been confirmed, and a vendor fix is available.
Code injection in Javo Core WordPress plugin versions ≤3.0.0.266 allows an unauthenticated remote attacker to execute arbitrary code with high attack complexity, leading to limited confidentiality, integrity, and availability impact on the host system. No public exploit or active exploitation is confirmed, and EPSS score is very low (0.07%).
Unauthenticated SQL injection in the WordPress tPlayer plugin (HTML5 audio player with playlist) versions up to 1.2.1.6 allows remote attackers to extract sensitive data from the database via crafted requests, with limited availability impact. The vulnerability has a CVSS score of 9.3, requires no user interaction, and is classified as CWE-89. At the time of analysis, no public exploit code or active exploitation is known, and EPSS probability is low (0.06%).
Unauthenticated attackers can modify IDonatePro WordPress plugin data (integrity impact high) due to missing authorization checks in versions up to 2.1.9. Exploitation requires no privileges or user interaction and is carried out over the network. At the time of analysis, no active exploitation, public exploit code, or CISA KEV listing exists; EPSS score is low (0.07%).
Unauthenticated arbitrary content deletion in the Javo Core WordPress plugin up to version 3.0.0.529 can allow attackers to delete site content, causing a complete loss of data availability. The missing authorization vulnerability carries a CVSS 3.1 score of 7.5 with low EPSS exploitation probability, and no active exploitation or public proof-of-concept has been identified at the time of analysis.
Privilege escalation in e-plugins Hotel Listing plugin for WordPress (≤1.4.0) allows authenticated low-privileged attackers to gain administrator access. Successful exploitation could lead to full site compromise. No public exploit code or active exploitation has been confirmed; EPSS indicates low exploitation probability (0.08%).
Missing authorization in the Download After Email WordPress plugin versions 2.1.5 through 2.1.6 allows unauthenticated attackers to bypass access controls and access protected downloads intended for users who submit their email. The vulnerability has a CVSS base score of 5.8 (medium) but EPSS exploitation probability is very low (0.08%), and no public exploit or active exploitation has been reported.
Super Blank WordPress plugin versions up to 1.2.0 are vulnerable to missing authorization, allowing authenticated attackers with low privileges to delete arbitrary content. This can result in complete loss of site content availability; no active exploitation has been detected, and the EPSS likelihood is very low.
DigitalME eRoom eroom-zoom-meetings-webinar plugin through version 1.5.6 exposes sensitive data in sent communications due to improper data handling, allowing unauthenticated remote attackers with user interaction to retrieve embedded sensitive information across site boundaries. EPSS exploitation probability is low at 0.04%, but the vulnerability affects confidentiality, integrity, and availability through information disclosure mechanisms that may be chained with other flaws.
Information disclosure in VikBooking Hotel Booking Engine & PMS plugin for WordPress (versions n/a through 1.8.2) allows unauthenticated remote attackers to retrieve embedded sensitive data from HTTP responses. The insertion of sensitive information into sent data (CWE-201) can expose credentials, API keys, or other secrets, with a CVSS base score of 5.9 (AV:N/AC:H/PR:N/UI:N). No active exploitation or public exploit code is known at this time.
Unauthenticated modification of login page design in the Login Page Customizer WordPress plugin (<=2.1.1) allows remote attackers to alter the site's login and admin page customizations due to missing authorization checks. The vulnerability has low integrity and availability impact, and EPSS indicates very low exploitation probability with no known active exploitation or public exploit code.
Unauthenticated missing authorization in The African Boss Get Cash WordPress plugin up to 3.2.3 allows remote attackers to modify plugin data and potentially disrupt cash-related functionality without any prior access. The vulnerability carries a Medium severity with low EPSS exploitation likelihood, and no active exploitation or public PoC has been reported.
Blind SQL injection in the PopupKit WordPress plugin through version 2.1.5 allows authenticated attackers with low privileges to extract sensitive database information without user interaction. The vulnerability, assigned CWE-89, has a high CVSS score but a very low EPSS probability (0.05%), and no known public exploits or active exploitation have been identified at this time.
Authorization bypass in the Contact Form Email plugin for WordPress (versions <= 1.3.60) enables unauthenticated attackers to modify or remove contact form entries by manipulating user-controlled key values, with no confidentiality impact. No user interaction required, and the vulnerability is exploitable remotely, though EPSS indicates a low probability of widespread exploitation.
Authenticated users with limited privileges can modify plugin settings and access functionality they should not have access to via missing authorization checks in Buttoner for Elementor through version 1.0.6. The vulnerability requires valid WordPress user credentials but no administrative role, allowing privilege escalation within the plugin's configuration interface. EPSS score of 0.05% indicates low exploitation probability despite network accessibility.
Broken access controls in Ultimate Auction plugin for WordPress up to version 4.3.3 allow low-privileged attackers to modify or disrupt auction operations. The missing authorization checks (CWE-862) enable unauthorized changes without user interaction, impacting integrity and availability but not confidentiality. No active exploitation or public exploit code has been reported; EPSS indicates a low exploitation probability.
Cross-site request forgery in the Meks Quick Plugin Disabler WordPress plugin (≤1.0) allows an attacker to trick a logged-in administrator into disabling plugins, leading to potential service disruption. No active exploitation or public exploit code is known; EPSS probability is 0.03%.
Cross-Site Request Forgery in the Semrush Content Toolkit WordPress plugin allows attackers to trick authenticated users into performing unauthorized actions. All versions up to 1.1.32 are vulnerable. No active exploitation or public exploit code has been reported, and EPSS score indicates very low likelihood of widespread exploitation.
Stored cross-site scripting (XSS) in ThemeNectar Salient Shortcodes WordPress plugin through version 1.5.4 allows authenticated users with low privileges to inject malicious scripts that execute in the context of higher-privileged administrators or other site visitors. The vulnerability requires user interaction (UI:R in CVSS vector) and affects the shortcode generation functionality, enabling persistence of malicious payloads in page content. EPSS score of 0.06% indicates low real-world exploitation probability despite the moderate CVSS 6.5 rating.
Authorization bypass in Essential Real Estate WordPress plugin versions through 5.2.9 allows authenticated users to access sensitive real estate data they should not have permission to view through user-controlled key manipulation. The vulnerability exploits incorrectly configured access control at the application level, enabling privilege escalation from a standard user account to view confidential information such as property details or pricing. No public exploit code has been identified, and the EPSS score of 0.04% indicates low exploitation probability despite the CVSS 6.5 severity rating.
Local file inclusion in the Stockholm Core WordPress plugin (≤2.4.6) allows authenticated users with low privileges to include arbitrary local files, potentially leading to sensitive data exposure or remote code execution. No active exploitation or public exploit code is known at this time, though the low EPSS score indicates limited real-world risk despite the high CVSS impact.
Local File Inclusion in the Hub Core WordPress plugin (LiquidThemes, versions through 5.0.8) allows an authenticated network attacker with low privileges to supply a crafted filename parameter that is passed unsanitized to a PHP include/require statement, enabling inclusion of arbitrary server-side files. Successful exploitation can expose sensitive configuration data (wp-config.php, credentials) or, under favorable server conditions such as log poisoning, escalate to remote code execution and full site compromise. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; EPSS sits at 0.08%, reflecting low current exploitation activity.
SQL injection in LBG Zoominoutslider WordPress plugin versions through 5.4.4 allows authenticated attackers with low-level privileges to extract sensitive database information and potentially cause denial of service. The vulnerability enables cross-scope impact, meaning attackers can access resources beyond their authorized privilege level. EPSS probability is low (0.04%, 14th percentile), indicating limited observed exploitation activity, though Patchstack's disclosure suggests active security community awareness.
SQL injection in Themefic Hydra Booking for WordPress allows authenticated attackers to read sensitive database contents. The vulnerability affects versions up to 1.1.32 and is reachable over the network with low-privilege access. No public exploit is known and EPSS indicates low exploitation probability.
Blind SQL injection vulnerability in the LambertGroup CountDown With Image or Video Background WordPress plugin (versions up to 1.5) allows authenticated users with minimal privileges (e.g., subscriber) to extract sensitive database information. No active exploitation or public exploit code is known at this time, and EPSS indicates a very low probability of real‑world attacks.
Blind SQL injection in the xPromoter top_bar_promoter WordPress plugin versions up to 1.3.4 permits authenticated attackers with low privileges to extract sensitive data from the database. Exploitation requires sending crafted requests to a vulnerable plugin endpoint, potentially exposing user credentials and configuration details. No public exploit code or active exploitation has been reported, and EPSS score indicates a low probability of widespread attacks.
Blind SQL injection in the Newsletter plugin for WordPress up to
DOM-based cross-site scripting in the Document Library Lite WordPress plugin (versions <=1.1.7) allows authenticated attackers with high privileges to execute arbitrary JavaScript in the browser of an administrator who visits a crafted page. This could lead to account compromise or malicious actions within the WordPress admin.
Insecure direct object reference in Barn2 Document Library Lite plugin for WordPress allows unauthenticated remote attackers to read arbitrary documents by manipulating a user-controlled key parameter. Affected versions include all releases up to and including 1.1.7, with low confidentiality impact and no integrity or availability loss.
Remote unauthenticated attackers can exploit missing authorization checks in the Homey Core plugin (versions ≤ 2.4.3) to degrade service availability. The vulnerability stems from a missing authorization flaw (CWE-862) that permits unauthorized interaction with vulnerable endpoints. No public exploit code has been identified and active exploitation is not confirmed at the time of analysis.
SQL injection vulnerability in the Broken Link Checker SEO WordPress plugin up to version 1.2.6 allows authenticated administrators to execute arbitrary SQL commands, potentially exposing sensitive information from the database. The flaw, tracked as CVE-2025-67962, carries a CVSS 3.1 base score of 7.6 from Patchstack but is limited to high-privileged users, and no public exploit code or active exploitation (KEV) has been observed. The low EPSS score of 0.06% further suggests minimal real-world exploitation probability at this time.
Blind SQL injection in the All In One SEO Pack WordPress plugin through version 4.9.1 allows authenticated attackers with subscriber-level access to execute arbitrary SQL queries, potentially extracting sensitive database contents.
Missing authorization in NinjaTeam FileBird Pro WordPress plugin versions up to 6.5.1 allows authenticated users to access and modify files they should not have permission to view or edit due to incorrectly configured access control security levels. The vulnerability requires valid user credentials but can lead to disclosure and modification of sensitive files within the plugin's file management interface. EPSS exploitation probability is low at 0.04%, and no public exploit code has been identified at the time of analysis.
Missing authorization in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin versions up to 4.0.7 allows unauthenticated attackers to modify cookie consent settings, potentially undermining the site’s compliance posture. No active exploitation or public proof-of-concept has been identified, and the EPSS score (0.05%) indicates very low exploitation probability.
Authorization bypass in FAPI Member WordPress plugin through version 2.2.29 allows unauthenticated remote attackers to access or modify resources via insecure direct object references (IDOR) exploiting misconfigured access control security levels. The vulnerability requires no authentication, low attack complexity, and results in confidentiality and integrity impact without availability compromise. EPSS score of 0.04% indicates minimal real-world exploitation probability despite the moderate CVSS score.
Broken access control in Yaad Sarig Payment Gateway for WooCommerce (versions ≤2.2.11) allows unauthenticated remote attackers to bypass authorization checks and gain unauthorized access to payment gateway functions. With CVSS 9.1 (Critical) scoring reflecting network-accessible exploitation requiring no privileges or user interaction, attackers can read or modify sensitive payment data. EPSS score of 0.04% (14th percentile) suggests low observed exploitation probability despite severity. No public exploit identified at time of analysis, though the authentication bypass tag indicates potential for unauthorized transaction manipulation or data exposure in WordPress e-commerce environments.
Missing authorization in g5theme Essential Real Estate WordPress plugin version 5.2.9 and earlier allows authenticated users to access or modify restricted resources by exploiting inadequately configured access controls. An attacker with low-privilege WordPress account credentials can leverage the broken access control to view sensitive information and make unauthorized modifications without requiring administrative approval. No public exploit code is currently identified, though the vulnerability is documented in the Patchstack security database.
Information disclosure in wowpress.host Fix Media Library up to version 2.0 allows unauthenticated attackers to retrieve sensitive data embedded in sent data. The vulnerability, disclosed by Patchstack, has a CVSS 5.3 (medium) and a low EPSS exploitation probability (0.05%), with no known public exploits at this time.
Sensitive information disclosure in WordPress Ultimate Auction plugin up to version 4.3.3 allows unauthenticated remote attackers to retrieve embedded sensitive data from the application's responses. No authentication is required, making exploitation simple with only network access needed. Current threat intelligence indicates a very low risk of exploitation, with no active attacks observed.
Unauthenticated remote attackers can bypass access controls in ZEEN101 Leaky Paywall WordPress plugin versions up to 4.22.6, gaining unauthorized access to restricted content through incorrectly configured security levels. The vulnerability requires no user interaction and can be exploited over the network, though it is limited to information disclosure (CVSS 5.3, EPSS 0.04%). No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated access to a sensitive function in the Stylish Price List WordPress plugin through version 7.2.2 allows remote attackers to degrade service availability. The missing authorization check can be leveraged to perform actions that impact the plugin's availability without requiring login credentials. No active exploitation or public exploit code has been identified.
Missing authorization in the SiteGround Security plugin for WordPress (≤1.5.8) allows unauthenticated remote attackers to trigger availability disruptions by exploiting incorrectly configured access controls. The vulnerability has a CVSS 5.3 (Medium) but EPSS scores only 0.05%, indicating minimal predicted exploitation; no active attacks or public exploit code have been observed.
Unauthenticated information disclosure in the CatFolders WordPress plugin up to version 2.5.3 allows remote attackers to access restricted data via a missing authorization check. No public exploit is known, and EPSS indicates a low exploitation probability (0.05%).
Missing authorization in WP Compress for MainWP plugin versions up to 6.50.17 allows unauthenticated remote attackers to modify plugin settings due to incorrectly configured access control, affecting integrity of compressed content and plugin configuration without requiring authentication or user interaction.
Unauthenticated modification of plugin data affects Feeds for YouTube plugin for WordPress through version 2.4.0. The vulnerability stems from a missing authorization check, allowing remote attackers to alter settings without authentication. Despite a CVSS base score of 5.3, only low integrity impact is possible, and no active exploitation or public proof-of-concept has been identified at the time of analysis.
Unauthenticated remote attackers can access sensitive sitemap data in Google XML Sitemaps WordPress plugin versions through 4.1.22 due to missing authorization checks on sitemap endpoints. The vulnerability allows unauthorized information disclosure of site structure and indexed pages without requiring authentication or user interaction. While the CVSS score is moderate (5.3), real-world exploitation probability is very low (EPSS 0.04th percentile), suggesting this is primarily an information disclosure risk rather than an active threat.
WCFM Marketplace plugin through version 3.7.1 fails to properly enforce authorization controls, allowing authenticated users with limited privileges to cause denial of service or access functionality they should not have. The vulnerability affects the WordPress plugin across all installations through the specified version, exploiting incorrectly configured access control security levels via network-accessible endpoints. With an EPSS score of 0.05% and low real-world exploitation probability, this represents a privilege escalation risk primarily for multi-vendor marketplace administrators.
Denial-of-service vulnerability in Strategy11’s Business Directory Plugin for WordPress (≤ 6.4.19) allows authenticated high-privileged attackers to disrupt site availability. The flaw stems from missing authorization checks, permitting an admin-level user to trigger an action with high availability impact. No public exploit is known, and EPSS (0.06%) indicates low exploitation probability despite the network-based attack vector.
Arbitrary content deletion in WordPress Ultimate Learning Pro plugin versions <= 3.9.3 allows authenticated high-privilege users to delete learning content without proper authorization checks. An attacker with instructor or administrator access can delete arbitrary posts, lessons, or courses, resulting in high integrity impact but no data theft or system disruption. The vulnerability is not known to be actively exploited and has very low exploitation likelihood (EPSS 0.05%).
Open redirect vulnerability in wpWax Directorist WordPress plugin versions up to 8.6.6 allows unauthenticated remote attackers to redirect users to arbitrary external websites via crafted URL parameters, enabling phishing attacks. The vulnerability requires user interaction (clicking a malicious link) but has a network attack vector with low complexity. EPSS exploitation probability is very low at 0.04%, and no active exploitation or public proof-of-concept has been identified.
Denial of service in WordPress Protect WP Admin plugin <=4.1 allows unauthenticated remote attackers to degrade availability. A missing authorization check enables exploitation of incorrectly configured access control security levels, causing a low-impact loss of availability without affecting confidentiality or integrity. The vulnerability has a low EPSS score (0.05%) and no known public exploit or active exploitation.
Missing authorization in the WordPress Read More & Accordion plugin (expand-maker) versions 3.5.5.1 and earlier allows authenticated users to access restricted functionality through incorrectly configured access controls, potentially revealing sensitive information. The vulnerability requires user authentication and network access but carries a CVSS score of 6.5 due to high confidentiality impact, though real-world exploitation probability remains low at 0.04% EPSS. No public exploit code or active exploitation has been identified at time of analysis.
Authenticated low-privileged users can exploit missing authorization in the Accessibility by AudioEye WordPress plugin (≤1.0.49) to modify plugin data, resulting in a limited integrity impact. The vulnerability allows attackers with subscriber roles to bypass access controls on plugin endpoints, though no active exploitation or public exploit code is currently known. The CVSS score of 4.3 reflects its low severity.
Unauthorized access to attachment management exists in the Import external attachments WordPress plugin, allowing low-privileged users to modify external attachment settings or data without proper authorization checks. Versions up to 1.5.12 are vulnerable, and remote attackers with subscriber-level or similar accounts can exploit this missing authorization (CWE-862). No active exploitation or public proof-of-concept code is reported at the time of analysis, and EPSS indicates a low exploitation probability (0.05%).
Unauthorized modification of Elementor widget restrictions in the Restrict Elementor Widgets plugin for WordPress allows authenticated users with low privileges to bypass access controls. Affecting versions up to and including 1.12, this missing authorization flaw can be exploited to alter widget, column, and section restrictions without proper permissions. No active exploitation is confirmed, and the EPSS score remains low at 0.05%.
Low-privileged authenticated users of the e-plugins Directory Pro WordPress plugin (<=2.5.6) can bypass access controls due to a missing authorization flaw, potentially modifying plugin data. The vulnerability has a medium CVSS score (4.3) with low integrity impact, and no active exploitation or public exploit has been reported; EPSS score of 0.05% indicates a low probability of in-the-wild attacks.
Inadequately configured access control in Easy Property Listings WordPress plugin versions 3.5.21 and earlier allows authenticated users to access sensitive information they should not be authorized to view. An authenticated attacker with user-level privileges can bypass authorization checks to read property listing data or other restricted content due to missing authorization validation on API endpoints or functionality. EPSS exploitation probability is very low at 0.04%, and no public exploit code has been identified, indicating limited real-world threat despite the authentication-bypass tag.
Authenticated attackers with low-level privileges can modify plugin data in the WP Coupons and Deals WordPress plugin through version 3.2.4 due to missing authorization checks. This integrity-only impact (CVSS 4.3) requires an already-authorized low-privilege user account, limiting risk. No active exploitation has been reported, and the EPSS probability is 0.05% (14th percentile), indicating very low exploitation likelihood.
Cross-site request forgery in the RTL Tester WordPress plugin through version 1.2 allows unauthenticated attackers to trick administrative users into toggling the RTL test mode, causing temporary site layout changes. This low-severity issue (CVSS 4.3) has a very low exploitation probability (EPSS 0.03%) and no known active exploitation or public exploit code.
Authenticated low-privilege attackers can bypass access controls in the WPS Bidouille WordPress plugin through version 1.33.1, allowing unauthorized modification of plugin data. The vulnerability has a low EPSS score (0.05%) and no public exploit or active exploitation is currently reported.
Cross-site request forgery in the Quick Interest Slider WordPress plugin (versions up to 3.1.5) allows unauthenticated attackers to deceive authenticated administrators into executing unauthorized actions, such as modifying plugin settings. No public exploit code or active exploitation has been identified, and EPSS predicts a very low exploitation probability.
We are tasked to synthesize data from multiple intelligence sources about CVE-2025-59001 into a comprehensive analysis, returning a JSON object with specific fields. We need to cross-reference the data, provide original synthesis, and adhere to strict rules. Input data: - CVE ID: CVE-2025-59001 - Description: "Missing Authorization vulnerability in ThemeNectar Salient Core salient-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Salient Core: from n/a through <= 3.0.8." - CVSS Score: 4.3 - CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - CWE: CWE-862 (Missing Authorization) - EPSS Score: 0.05% (percentile 16%) - Reported by: audit@patchstack.com - Tags: Authentication Bypass (Note: tags might be from Patchstack, but we'll incorporate) - References: [nvd] (None) but actually a Patchstack URL: https://patchstack.com/database/Wordpress/Plugin/salient-core/vulnerability/wordpress-salient-core-plugin-3-0-8-broken-access-control-vulnerability?_s_id=cve - Also, there is no KEV status provided, no POC status mentioned. We must not assume KEV. Our exploitation status phrase: no public exploit identified at time of analysis (since no KEV, no POC stated). But wait, Patchstack might have reported, but we have no explicit "POC=YES" in the data. So we'll use that phrase. We need to fill fields: 1. product_name: "1-3 words ONLY. The specific product or service name affected." It's "Salient Core". That's a WordPress plugin by ThemeNectar. So "Salient Core" works. 2. summary: "2-3 sentence plain-language summary for security professionals. CRITICAL: Do NOT copy or paraphrase the Description — write an original synthesis using all available data. Do NOT start with 'A vulnerability', 'A problem', 'A flaw', or 'An issue'. Start with the specific impact verb and product, e.g. 'Remote code execution in Apache Tomcat 9.x allows...' or 'Cortex XDR agent on macOS can be disabled by local admins via...'. Explain WHAT the vulnerability is, WHO is affected (specific product/version), and WHAT an attacker can do. Mention if actively exploited (KEV), if POC exists, and EPSS risk if notable." So, missing authorization in Salient Core plugin <=3.0.8 allows authenticated users to exploit incorrectly configured access control to modify some data (I:L, integrity impact low, no confidentiality or availability). No active exploitation known, and EPSS is low (0.05%). So summary: "Authenticated attackers can exploit a missing authorization check in ThemeNectar Salient Core plugin versions through 3.0.8 to modify data without proper permissions. The vulnerability results from incorrectly configured access control security levels, with low integrity impact and no confidentiality or availability impact. EPSS probability is very low (0.05%), and no public exploit code or active exploitation has been identified at this time." That's original. 3. technical_context: "Explain the underlying technology/library/protocol involved. Use CPE data to identify exact affected products. Reference the CWE to explain the root cause class. Be specific and educational." No CPE data provided, so we can mention that CPE is not available, but the product is a WordPress plugin. We can talk about missing authorization (CWE-862) and how access control in WordPress plugins can be misconfigured. Also, the Patchstack link likely provides details. We'll say: "The Salient Core plugin for WordPress is affected by a missing authorization vulnerability (CWE-862). This class of weakness occurs when a web application does not properly restrict access to privileged functionality, allowing low-privileged authenticated users to perform actions that should require higher permissions. The vulnerability is in the plugin's access control mechanisms, which fail to enforce correct security levels. No CPE information is provided, but the vendor's plugin is available on WordPress.org or ThemeNectar's site." 4. risk_assessment: "Assess real-world risk using ALL available signals: CVSS vector (attack vector, complexity, privileges), EPSS exploitation probability, KEV status, POC availability, SSVC decision framework (exploitation status, automatable, technical impact). Compare and contrast these signals. Is this a real priority or just a high-CVSS-but-low-real-risk issue? If any key data is missing or conflicting, STATE IT EXPLICITLY, e.g.: 'CVSS indicates network vector but description implies local access — verify with vendor.' or 'EPSS score is low despite KEV listing, suggesting targeted rather than widespread exploitation.' Do NOT present uncertain information as confirmed fact." So here: CVSS 4.3, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. It's network exploitable, low complexity, low privileges required (authenticated, any user), no user interaction, unchanged scope, only integrity low impact. EPSS 0.05% (very low). No KEV, no POC. SSVC: exploitation=none (no public exploit), automatable=maybe (AC:L, but needs authentication, so perhaps not fully automatable without credentials), technical impact=partial (integrity modification). So risk is low. We'll say: "The CVSS score is low (4.3) due to limited impact, but the vector indicates an authenticated remote attack with low complexity. EPSS probability of exploitation is negligible (0.05%, percentile 16%), and there is no evidence of active exploitation or public exploit code. This vulnerability does not appear to be a high-priority threat, as it requires authentication and only allows integrity modification, not compromising confidential data or system availability. The missing authorization likely stems from a configuration specific to the plugin's access control levels, so risk is contextual." A note: no data conflicts; CVSS aligns with description. 5. affected_products: "Write a concise paragraph listing affected products with their versions. Include product name, version range, CPE if available, and link to vendor advisory from references. Do NOT use bullet points, JSON, or key-value formatting." So: "ThemeNectar Salient Core plugin for WordPress, versions from n/a through 3.0.8, are affected. The vendor advisory is available at https://patchstack.com/database/Wordpress/Plugin/salient-core/vulnerability/wordpress-salient-core-plugin-3-0-8-broken-access-control-vulnerability?_s_id=cve." (Use the reference link). No CPE mentioned, so skip that. 6. remediation: "Write a concise paragraph with actionable remediation steps. Start with the primary fix (patch/upgrade with exact version), then mention workarounds if relevant. Include advisory URLs from references. If no patch is available, suggest SPECIFIC compensating controls with their trade-offs — not generic 'apply defense in depth' but actionable: 'Disable X feature', 'Block Y port', 'Restrict access to Z endpoint'. Note side effects of each mitigation. Do NOT use bullet points, JSON, or key-value formatting." The description says "from n/a through <= 3.0.8", implying that version 3.0.8 is the highest affected, and presumably fixed in version above that, but no specific fix version is given. Patchstack advisory may have details. Since we only have the link, we can check if it says "Fixed in version: 3.0.9" or something. But we don't have that info from the input, just the URL. I can't access it, so I'll assume there is a patch. The data says "Missing Authorization vulnerability... This issue affects Salient Core: from n/a through <= 3.0.8." Typically, Patchstack entries include a fixed version. But in this input, no fix version explicitly. I'll phrase: "Upgrade Salient Core to a version newer than 3.0.8. The vendor has not explicitly announced a fixed version in the CVE data, but the advisory at Patchstack likely provides details. As a workaround, administrators can restrict access to the affected plugin's functionality by reviewing and hardening access control settings until an update is applied, though this may require manual configuration review." But we must not invent version numbers. If no patch is known, I will state that. However, given the structure, I'll say "Update to a patched version beyond 3.0.8" – but that is an inference. Better: "The advisory at Patchstack (see reference) indicates the vulnerability affects versions up to 3.0.8; update to the latest version, which should contain the fix. If no patch is yet available, restrict access to authenticated users with necessary roles, or disable the plugin temporarily. Disabling the plugin may affect functionality dependent on Salient Core." I'll incorporate the reference. 7. exploit_scenario: "Brief realistic attack scenario in 2-3 sentences. If POC exists, note that. Factor in attack vector and complexity from CVSS." No POC exists. Attack scenario: "An authenticated low-privileged user, such as a subscriber on a WordPress site, crafts a request to a Salient Core endpoint that lacks proper authorization checks. Due to missing access control, the user modifies settings or content they should not have permission to alter, leading to unauthorized data modification." This matches AV:N, PR:L, UI:N, I:L. 8. exploitation_conditions: "CRITICAL FIELD — security teams make real decisions based on this. Extract SPECIFIC, CONCRETE prerequisites from the CVE description. Name the EXACT product feature, protocol, configuration setting, or deployment mode required. If the description says 'when configured with...' or 'if the X feature is enabled' — that IS the condition. If genuinely no special conditions (AV:N/AC:L/PR:N/UI:N), state: 'No special conditions — remote unauthenticated exploitation against default configurations of [PRODUCT NAME].' Also state what LIMITS exploitation: required user interaction, authentication level, non-default configuration, specific platform/version. These limiting factors help defenders assess realistic risk beyond raw CVSS score. FORBIDDEN generic phrases: 'Network access required.' / 'Specific configuration needed.' / 'Depends on deployment.'" From the description: "Missing Authorization vulnerability ... allows Exploiting Incorrectly Configured Access Control Security Levels." This implies that the vulnerability is due to incorrectly configured access control security levels. So the condition might be that access control security levels are not correctly configured. However, the CVSS vector has PR:L, so it requires authentication with low privileges. So specific conditions: "Exploitation requires an authenticated user with low privileges (e.g., subscriber) on a WordPress site where the Salient Core plugin is active. The vulnerability manifests when access control security levels are misconfigured, potentially due to the plugin's default settings. No user interaction is required. No other special conditions; the attack vector is network-based, and complexity is low." That's specific enough. The "incorrectly configured" might be inherent to the plugin's code rather than a site-specific misconfiguration, but it's a missing authorization check. So I'll phrase: "Exploitation requires an authenticated low-privilege user account on a WordPress instance running Salient Core 3.0.8 or earlier. The vulnerability exists in the plugin's access control mechanisms, specifically when handling requests to certain endpoints where permissions are not properly enforced. No other prerequisites such as enabled features or non-default settings are needed, but the attacker must have valid credentials." 9. attack_chain: "3-7 short steps separated by ' → ' (arrow), following kill chain phases. Use as many steps as the attack realistically requires. Each step is 3-8 words. Must be grounded in actual CVE data (attack vector, privileges, scope from CVSS). Phase templates by length: 3-step: Access → Exploit → Impact. 4-step: Access → Exploit → Execution → Impact. 5-step: Access → Delivery → Exploit → Execution → Impact. 6-step: Access → Delivery → Exploit → Execution → Persist → Impact. 7-step: Recon → Delivery → Exploit → Install → C2 → Execute → Impact. Example: 'Send crafted HTTP request → Trigger buffer overflow in parser → Execute arbitrary code as root'. No numbering, no prose, just the chain." So: Access: "Authenticate with low-privilege user account" -> Exploit: "Send request to unprotected endpoint" (or "Craft request to bypass authorization") -> Impact: "Modify data without proper authorization". That's 3 steps: "Authenticate as low-privileged user → Send crafted request to missing-auth endpoint → Unauthorized data modification". Alternatively, could be 4 steps: Access -> Delivery (sending the request) -> Exploit (the missing check allows access) -> Impact. But 3 steps suffices: "Access: obtain low-privilege credentials" → "Exploit: invoke
Authenticated users with limited privileges can access search and replace functionality in CM On Demand Search And Replace WordPress plugin (versions up to 1.5.5) due to missing authorization checks on restricted features. An attacker with basic user credentials can perform privileged actions intended only for administrators, affecting data confidentiality through unauthorized content access. This is confirmed as an authentication bypass vulnerability with low real-world exploitation probability (EPSS 0.04%) despite the missing authorization flaw.
Missing authorization in the SKT Page Builder WordPress plugin allows authenticated attackers to modify page content. The vulnerability permits low-privilege users (e.g., subscribers) to perform unauthorized actions due to incorrectly configured access control security levels. No public exploit or active exploitation is confirmed, but the low privilege requirement poses a moderate insider threat risk.
Missing Authorization vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.3.0. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cross-Site Request Forgery in PSM Plugins SupportCandy allows remote attackers to perform unintended actions in the WordPress plugin by tricking a logged-in administrator into visiting a malicious link. This vulnerability affects SupportCandy versions up to and including 3.4.1. No exploitation or public proof-of-concept is known, and the EPSS probability is extremely low at 0.03%.
Missing authorization in Fluent Booking WordPress plugin through version 1.9.11 allows authenticated low-privileged users to modify data without proper access controls. This integrity-only flaw can lead to unauthorized changes in booking information on affected sites.
Cross-Site Request Forgery in Strategy11 Team Business Directory plugin allows attackers to perform unauthorized actions on behalf of authenticated administrators. Affecting installations up to version 6.4.19, this flaw can be triggered when a logged-in user visits a malicious website. No active exploitation or public exploit code is known, and EPSS indicates a very low likelihood of widespread attacks.
Cross-Site Request Forgery in the Quiz Maker WordPress plugin by Ays Pro up to version 6.7.0.82 allows unauthenticated attackers to perform unauthorized actions on behalf of authenticated site administrators. No active exploitation or public exploit code has been identified, and a vendor patch is available via a later version.
Authorization bypass through user-controlled key in ThimPress Thim Elementor Kit plugin up to version 1.3.3 allows authenticated attackers to modify data via insecure direct object references. The vulnerability has a CVSS base score of 4.3, a low EPSS exploitation probability (0.07%), and no known public exploit or active exploitation.
Cross-Site Request Forgery (CSRF) in the UsersWP WordPress plugin up to 1.2.48 allows unauthenticated attackers to perform low-integrity actions by tricking an authenticated user into clicking a crafted link. Only the integrity of the targeted user’s data is affected, with no risk to confidentiality or availability. No active exploitation or public exploit code has been identified.
Authenticated low-privilege users can modify calendar data in My Calendar WordPress plugin versions <= 3.6.16 due to missing authorization checks, allowing unauthorized integrity impact. The flaw has a CVSS score of 4.3, very low exploitation probability (EPSS 0.05%), and no known active exploitation or public exploit code at time of analysis.
Cross-site request forgery (CSRF) in the JNews Paywall WordPress plugin (versions < 12.0.1) allows remote attackers to trick logged-in administrators into performing unintended actions, such as modifying plugin settings, by inducing them to click a malicious link. The vulnerability carries a CVSS base score of 4.3 (Medium) and an EPSS probability of 0.03%, indicating very low anticipated exploitation rates. No public exploit or active exploitation is currently reported.
Cross-site request forgery in the Ultimate FAQ WordPress plugin through version 2.4.3 allows unauthenticated attackers to trick authenticated administrators into performing unintended actions, such as modifying FAQ content. The vulnerability carries a CVSS 4.3 (medium) and a very low EPSS exploitation probability (0.03%), with no evidence of active exploitation or public proof-of-concept at time of analysis.
Missing authorization checks in Elementor Website Builder (WordPress plugin) through version 3.33.0 allow authenticated low-privilege users to perform actions beyond their intended access level. Exploitation requires a valid WordPress account with low privileges (PR:L per CVSS vector), and the impact is limited to partial integrity modification with no confidentiality or availability consequences. No public exploit code or active exploitation has been identified; EPSS places this at the 14th percentile, reflecting low real-world exploitation probability.
Open redirect in CRM Perks WP Gravity Forms FreshDesk Plugin up to 1.3.5 allows unauthenticated attackers to craft URLs that redirect users to arbitrary untrusted sites, facilitating phishing attacks. The vulnerability has no known active exploitation or public exploit, and EPSS indicates a very low exploitation probability.
The Highlight and Share WordPress plugin up to version 5.2.0 contains a missing authorization vulnerability that allows unauthenticated attackers to bypass access controls. Exploitation requires user interaction and can lead to unauthorized modification of plugin settings or limited information disclosure. Publicly available exploit code exists, but the vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities catalog.
Missing authorization controls in IDonate WordPress plugin through version 2.1.15 allows unauthenticated remote attackers to access sensitive information due to incorrectly configured access control security levels. The vulnerability has a low EPSS score (0.04%, 13th percentile) and no public exploit code or active exploitation is documented, indicating limited real-world attack incentive despite network-accessible attack surface.