CVE-2025-58249
BaseFortify
Publication date: 2025-09-22
Last updated on: 2026-04-23
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| themeum | qubely | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-201 | The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in the WordPress Qubely Plugin (up to version 1.8.14) allows a malicious user with Contributor-level privileges to access sensitive information that should normally be restricted. It is a Sensitive Data Exposure issue caused by broken access control, meaning unauthorized users can retrieve embedded sensitive data. The severity is considered low with a CVSS score of 4.3. [1]
How can this vulnerability impact me? :
If exploited, this vulnerability can expose sensitive information to users who should not have access, potentially enabling further attacks or exploitation of other system weaknesses. Although the risk is low and exploitation is unlikely to be widespread, sensitive data exposure can lead to privacy breaches or unauthorized data disclosure. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection involves monitoring for unauthorized access attempts by users with Contributor-level privileges to sensitive data normally restricted. Since no specific detection commands are provided, general WordPress audit logging and monitoring of user activities with Contributor roles is recommended. Consider using WordPress security plugins that log access or custom scripts to check for unusual data retrieval patterns. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation includes applying Patchstack's virtual patching (vPatch) solution, which auto-mitigates the vulnerability without requiring an official patch. Additionally, monitor for updates from the plugin developer, restrict Contributor-level user privileges where possible, and consider professional incident response if compromise is suspected. [1]