CVE-2025-69188
BaseFortify
Publication date: 2026-01-22
Last updated on: 2026-01-27
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| patchstack | fitness-trainer | to 1.7.1 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-69188 is a Broken Access Control vulnerability in the WordPress plugin "fitness-trainer" versions up to 1.7.1. It occurs due to missing authorization, authentication, or nonce token checks in certain functions, allowing unauthenticated users to perform actions that should be restricted to higher-privileged users. This means attackers can exploit the plugin without logging in to carry out unauthorized actions. [1]
How can this vulnerability impact me? :
This vulnerability can have a significant impact as it allows unauthenticated attackers to perform privileged actions on affected websites using the fitness-trainer plugin. This can lead to unauthorized changes, data manipulation, or other malicious activities that compromise the security and integrity of the website. Because no authentication is required, the risk of exploitation is high, potentially leading to data breaches or site defacement. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for unauthorized access attempts to privileged functions in the fitness-trainer WordPress plugin, especially those that do not require authentication. While no specific detection commands are provided, applying the Patchstack mitigation rule can help block and identify attack attempts targeting this flaw. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate steps include applying the mitigation rule provided by Patchstack to block attacks targeting this vulnerability until an official patch is released. This mitigation can be safely tested and deployed to protect affected websites. Additionally, monitoring and restricting access to the fitness-trainer plugin functions can help reduce risk. [1]