CVE-2025-49973
BaseFortify
Publication date: 2025-06-20
Last updated on: 2026-04-23
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-49973 is a Broken Access Control vulnerability in the WordPress plugin 'Image Sizes Controller, Create Custom Image Sizes, Disable Image Sizes' up to version 1.0.9. It involves missing authorization checks that allow an unprivileged user (such as one with Subscriber-level privileges) to perform actions that should be restricted to higher privileged users. This means that certain functions lack proper authentication or nonce token verification, potentially enabling unauthorized actions. [1]
How can this vulnerability impact me? :
This vulnerability could allow a low-privileged user to perform actions reserved for higher privileged users, potentially leading to unauthorized changes in image size settings on a WordPress site. Although the severity is considered low (CVSS score 4.3) and exploitation is unlikely, it could still result in improper configuration or manipulation of image sizes, which might affect site functionality or user experience. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
There are no specific detection commands or network/system detection methods provided for this vulnerability. Monitoring user privilege misuse or unauthorized actions within the WordPress plugin 'Image Sizes Controller, Create Custom Image Sizes, Disable Image Sizes' may help identify exploitation attempts, but no explicit commands are given. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include applying virtual patching (vPatching) provided by Patchstack to protect your site, monitoring for official updates or patches from the plugin developer, and restricting user privileges to prevent unprivileged users from performing higher-privilege actions. Since no official fix is currently available, virtual patching and careful access control are recommended. [1]