CVE-2025-49976
BaseFortify
Publication date: 2025-06-20
Last updated on: 2026-04-23
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Broken Access Control issue in the WordPress WANotifier plugin (up to version 2.7.7). It occurs due to missing authorization, authentication, or nonce token checks in certain functions, which can allow users with low-level privileges (Subscriber role) to perform actions that should be restricted to higher-privileged users. [1]
How can this vulnerability impact me? :
The impact of this vulnerability is considered low severity (CVSS score 4.3). It could allow a low-privileged user to perform unauthorized actions within the WANotifier plugin, potentially leading to limited unauthorized changes or misuse of plugin functionality. However, widespread exploitation is unlikely, and no direct impact on confidentiality or availability is indicated. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
There are no specific commands provided to detect this vulnerability on your network or system. Detection may require monitoring for unauthorized actions by low-privilege users (Subscribers) exploiting missing authorization checks in the WANotifier plugin. Plugin-based malware scanners are noted to be unreliable for this issue. No direct detection commands or tools are mentioned. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include applying virtual patching (vPatching) provided by Patchstack, which auto-mitigates the vulnerability without official patches and without performance loss. Additionally, timely updates of the plugin when available are recommended. If a website is compromised, professional incident response services should be engaged. Since no official fix is currently available, virtual patching is the primary recommended mitigation. [1]