CVE-2025-54714
BaseFortify
Publication date: 2025-08-28
Last updated on: 2026-04-23
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| patchstack | zephyr_project_manager | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-54714 is a Broken Access Control vulnerability in the WordPress Zephyr Project Manager Plugin versions up to 3.3.201. It allows users with subscriber-level privileges to perform actions that should be restricted to higher privilege levels due to missing authorization, authentication, or nonce token checks in certain functions. This means unauthorized users can exploit the plugin to access or modify data or functions they shouldn't be able to. [1]
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized access and actions within the Zephyr Project Manager Plugin, potentially allowing attackers to access sensitive information or perform unauthorized operations. Since it requires only subscriber-level privileges to exploit, it increases the risk of privilege escalation and data compromise. The impact includes confidentiality breaches and integrity issues, though availability is not affected. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of this vulnerability involves checking if the Zephyr Project Manager Plugin version is 3.3.201 or earlier, as these versions are affected. Since the vulnerability allows unprivileged users to perform higher privilege actions due to missing authorization checks, monitoring for unusual privilege escalations or unauthorized actions within the plugin is recommended. However, specific detection commands are not provided. Patchstack suggests that plugin-based malware scanners may be unreliable and recommends professional incident response services if compromise is suspected. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include applying the virtual patch (vPatch) provided by Patchstack to block attacks until the official fixed version is installed. Users should update the Zephyr Project Manager Plugin to version 3.3.202 or later, which resolves the vulnerability. Additionally, seeking professional incident response services is advised if the website has already been compromised. [1]