CVE-2025-49288
BaseFortify
Publication date: 2025-06-06
Last updated on: 2026-04-23
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-49288 is a Broken Access Control vulnerability in the WordPress Ultimate WP Mail plugin (versions up to 1.3.5). It occurs due to missing authorization, authentication, or nonce token checks in certain functions, which allows users with low privileges (Subscriber-level) to perform actions that should be restricted to higher-privileged users. [1]
How can this vulnerability impact me? :
This vulnerability can allow unprivileged users to perform unauthorized actions within the Ultimate WP Mail plugin, potentially leading to misuse or manipulation of mail functionalities. Although it has a low severity score (4.3) and is considered unlikely to be widely exploited, it still poses a risk of opportunistic automated attacks if not patched. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of this vulnerability involves checking the version of the Ultimate WP Mail plugin installed on your WordPress site. If the version is 1.3.5 or earlier, it is vulnerable. There are no specific network or system commands provided to detect exploitation attempts. You can verify the plugin version via WordPress admin dashboard or by running commands to check plugin versions, such as: wp plugin list | grep ultimate-wp-mail (using WP-CLI). Monitoring for unauthorized actions by Subscriber-level users attempting to perform higher-privileged actions may also indicate exploitation attempts. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to update the Ultimate WP Mail plugin to version 1.3.6 or later, which contains the fix for this vulnerability. Additionally, Patchstack offers virtual patching (vPatching) to auto-mitigate the vulnerability before official patches are applied. It is recommended to apply these updates promptly to prevent opportunistic automated attacks. [1]