CVE-2025-57949
BaseFortify
Publication date: 2025-09-22
Last updated on: 2026-04-23
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| patchstack | ongkoskirim.id_plugin | 1.0.6 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Broken Access Control issue in the WordPress Ongkoskirim.id plugin (up to version 1.0.6). It occurs due to missing authorization, authentication, or nonce token checks in certain functions, allowing users with low-level privileges (subscriber-level) to perform actions that should be restricted to higher-privileged roles. [1]
How can this vulnerability impact me? :
The vulnerability can allow unprivileged users to execute actions reserved for higher-privileged roles, potentially leading to unauthorized changes or disruptions. Since the plugin is abandoned and no official fix is available, the risk remains unless mitigated by removing the plugin or applying a virtual patch. Simply deactivating the plugin does not fully eliminate the threat. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection involves monitoring for unauthorized actions performed by users with subscriber-level privileges that should require higher privileges. Since the vulnerability allows broken access control, you can audit logs for suspicious activity such as privilege escalation attempts or unauthorized function calls within the Ongkoskirim.id plugin. Specific commands depend on your environment, but generally, you can check web server access logs for unusual POST or GET requests targeting the plugin's endpoints. For example, using grep to filter logs for plugin-related requests: `grep 'ongkoskirim-id' /var/log/apache2/access.log` or `grep 'ongkoskirim-id' /var/log/nginx/access.log`. Additionally, monitoring WordPress user activity logs or using security plugins that track user actions can help detect exploitation attempts. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include removing and replacing the Ongkoskirim.id plugin entirely, as no official fix or updated version is available. Simply deactivating the plugin is insufficient unless a virtual patch (vPatch) is applied. Patchstack recommends applying their virtual patching solution to auto-mitigate the vulnerability. Users should also consider alternative software to replace the plugin and seek professional incident response if compromise is suspected. [1]