CVE-2025-30974
BaseFortify
Publication date: 2025-06-06
Last updated on: 2026-04-23
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| addonmaster | post_grid_master | to 3.4.13 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
The vulnerability can allow low-privileged users to perform unauthorized actions within the Post Grid Master plugin, potentially leading to unauthorized modifications or misuse of the plugin's functionality. Although the severity is rated low (CVSS 4.3), exploitation could compromise the integrity of the affected website's content or configuration. [1]
Can you explain this vulnerability to me?
This vulnerability is a Missing Authorization issue in the WordPress Post Grid Master plugin (up to version 3.4.13). It is a Broken Access Control flaw where certain functions lack proper authorization, authentication, or nonce token checks. This allows users with low privilege levels, such as Subscribers, to perform actions that should be restricted to higher privilege users. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of this vulnerability involves identifying unauthorized access attempts or privilege escalation activities related to the Post Grid Master plugin. Since plugin-based malware scanners may be unreliable, it is recommended to monitor logs for suspicious actions performed by low-privilege users (e.g., Subscribers) attempting to access or modify restricted functions. Specific commands are not provided in the available resources. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include applying virtual patching (vPatching) solutions provided by Patchstack to automatically protect against exploitation despite the absence of an official patch. Additionally, users should seek professional incident response or assistance from their hosting provider if compromise is suspected. Monitoring and restricting user privileges to the minimum necessary can also help reduce risk. [1]