CVE-2025-52824
BaseFortify
Publication date: 2025-06-27
Last updated on: 2026-04-23
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a high-severity privilege escalation issue in the Mobile DJ Manager WordPress plugin (up to version 1.7.6). It is caused by missing authorization and incorrectly configured access control security levels, allowing an attacker with a low-privileged subscriber account to escalate their privileges to higher levels, potentially gaining full control over the affected website. [1]
How can this vulnerability impact me? :
If exploited, this vulnerability can allow an attacker to escalate their privileges from a low-level subscriber to higher privilege levels, potentially gaining full control over your website. This can lead to unauthorized access, data manipulation, and complete compromise of the affected site. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection involves monitoring for exploitation attempts targeting the Mobile DJ Manager plugin versions up to 1.7.6, especially privilege escalation activities from low-privileged subscriber accounts. Since no official patch exists, using the Patchstack virtual patch can help block exploitation attempts. For detection, it is recommended to perform malware scanning with professional incident response services or hosting provider tools, as plugin-based malware scanners may be unreliable. Specific commands are not provided in the resources. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include applying the Patchstack virtual patch (vPatch) released to block exploitation attempts until an official fix is available. Additionally, users should consider seeking professional incident response services or assistance from their hosting provider for malware scanning if compromise is suspected. Monitoring and restricting access to the vulnerable plugin versions is also advised. [1]