CVE-2025-50010
BaseFortify
Publication date: 2025-06-20
Last updated on: 2026-04-23
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Broken Access Control issue in the Zapier for WordPress plugin (versions up to 1.5.2). It involves missing authorization, authentication, or nonce token checks in certain functions, which can allow users with low privileges (Subscriber level) to perform actions that should be restricted to higher-privileged users. [1]
How can this vulnerability impact me? :
The vulnerability could allow an attacker with Subscriber-level access to perform unauthorized actions reserved for higher-privileged users. This could lead to unauthorized changes or access within the WordPress site, potentially compromising site integrity or security. However, the severity is considered low with a CVSS score of 5.4, and exploitation is unlikely. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of this vulnerability involves checking for unauthorized access attempts or actions performed by users with Subscriber-level privileges that should require higher privileges. Since the vulnerability is due to missing authorization checks in certain plugin functions, monitoring WordPress logs for suspicious activity related to the Zapier for WordPress plugin is recommended. However, plugin-based malware scanners may be unreliable for this issue. No specific commands are provided in the resources for detection. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include applying virtual patching (vPatching) solutions offered by Patchstack to auto-mitigate the vulnerability without performance loss, as no official patch is currently available. Additionally, restricting Subscriber-level privileges where possible and monitoring for suspicious activity is advised. If compromise is suspected, seek professional incident response services. [1]