CVE-2025-10750
BaseFortify
Publication date: 2025-10-18
Last updated on: 2025-10-21
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wordfence | embed_power_bi_reports | 1.2.0 |
| wordfence | embed_power_bi_reports | 1.2.1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-200 | The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability in the PowerBI Embed Reports WordPress plugin (up to version 1.2.0) is a Sensitive Information Disclosure issue. It occurs because the plugin lacks proper capability checks and authentication verification on the 'testUser' endpoint, which is accessible via the mo_epbr_admin_observer() function hooked on the 'init' action. This flaw allows unauthenticated attackers to access sensitive Azure Active Directory user information, including personally identifiable information (PII) such as displayName, mail, phones, department, and detailed OAuth error data like Azure AD Application/Client IDs, error codes, trace IDs, and correlation IDs. [3]
How can this vulnerability impact me? :
This vulnerability can impact you by exposing sensitive Azure AD user information to unauthenticated attackers. The leaked data includes personal identifiable information (PII) such as user display names, email addresses, phone numbers, and department details, as well as OAuth error information that could aid attackers in further exploiting the system. This exposure can lead to privacy violations, targeted phishing attacks, identity theft, and unauthorized access attempts against your organization's resources. [3]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability negatively affects compliance with data protection regulations such as GDPR and HIPAA because it allows unauthorized disclosure of personally identifiable information (PII). Exposing sensitive user data without proper authorization violates principles of data confidentiality and security mandated by these regulations, potentially leading to legal penalties, loss of trust, and mandatory breach notifications.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking if the WordPress site is running the PowerBI Embed Reports plugin version 1.2.0 or earlier. Specifically, you can test access to the 'testUser' endpoint exposed by the plugin without authentication, which leaks sensitive Azure AD user information. To detect this, you can use a command like: curl -i http://your-wordpress-site/wp-admin/admin.php?page=mo_epbr_admin_observer&option=testUser If the response returns sensitive user data such as displayName, mail, phones, or OAuth error details without requiring authentication, the site is vulnerable. Additionally, reviewing plugin versions installed on the WordPress site can help identify vulnerable versions. [3]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include updating the PowerBI Embed Reports plugin to version 1.2.1 or later, which contains security fixes addressing this vulnerability by adding capability checks, authentication verification, nonce validation, and secure input handling. If updating is not immediately possible, restrict access to the 'testUser' endpoint by implementing server-level access controls or disabling the plugin temporarily. Also, review and tighten WordPress user capabilities and authentication settings to prevent unauthenticated access to sensitive plugin endpoints. [2]