CVE-2025-69293
BaseFortify
Publication date: 2026-01-22
Last updated on: 2026-01-26
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| patchstack | final_user_plugin | to 1.2.5 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-266 | A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-69293 is a high-priority privilege escalation vulnerability in the WordPress Final User Plugin versions up to and including 1.2.5. It allows a malicious user with low-level privileges, such as a subscriber, to escalate their privileges to higher levels, potentially gaining full control over the affected website. This vulnerability is related to incorrect privilege assignment and is classified under OWASP Top 10 A7: Identification and Authentication Failures. [1]
How can this vulnerability impact me? :
This vulnerability can severely impact you by allowing an attacker with minimal access to escalate their privileges and gain full control over your WordPress website. This could lead to unauthorized access, data manipulation, site defacement, or other malicious activities that compromise the security and integrity of your site. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
There are no specific detection commands provided for this vulnerability. However, since it affects WordPress Final User Plugin versions up to 1.2.5, you can check the plugin version installed on your system to detect if you are vulnerable. For example, you can use WP-CLI commands like `wp plugin list` to verify the version of the Final User plugin. Monitoring for unusual privilege escalations or suspicious user activity may also help detect exploitation attempts. [1]
What immediate steps should I take to mitigate this vulnerability?
Since no official patch is available for this vulnerability, the immediate mitigation step is to apply the mitigation rule issued by Patchstack to block attacks exploiting this flaw. Users are strongly advised to implement this mitigation immediately to protect their websites. Additionally, consider restricting user privileges and monitoring for suspicious activity until an official fix is released. [1]