CVE-2025-49981
BaseFortify
Publication date: 2025-06-20
Last updated on: 2026-04-23
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a missing authorization issue in the WordPress User Roles and Capabilities plugin (up to version 1.2.6). It allows users with low-level privileges, such as subscribers, to perform actions that should be restricted to higher privileged users due to broken access control. This happens because certain plugin functions lack proper authorization, authentication, or nonce token checks. [1]
How can this vulnerability impact me? :
The vulnerability can allow attackers with low-level access to escalate their privileges and perform unauthorized actions on your WordPress site. Although the severity is considered low (CVSS 4.3), attackers may exploit this to compromise website security, potentially leading to unauthorized changes or access. Since the plugin is abandoned and unpatched, the risk remains unless mitigated by removing the plugin or applying virtual patches. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
There are no specific commands provided to detect this vulnerability on your network or system. Plugin-based malware scanners are discouraged due to their susceptibility to tampering. Detection would likely require monitoring for unauthorized privilege escalations or unusual actions by low-privilege users, but no explicit detection commands or methods are given. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate steps include removing and replacing the vulnerable User Roles and Capabilities plugin (version 1.2.6 or earlier) with an alternative solution. Applying a virtual patch (vPatch) from Patchstack can provide automatic mitigation in the absence of an official fix. Simply deactivating the plugin is insufficient to eliminate the risk. Consulting hosting providers or professional incident response services is recommended if compromise is suspected. [1]