CVE-2025-69347
Authorization Bypass in WPSubscription via Access Control Misconfiguration
Publication date: 2026-03-25
Last updated on: 2026-04-27
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| convers_lab | wpsubscription | to 1.8.10 (inc) |
| convers_lab | wpsubscription | From 1.0.0 (inc) to 1.8.10 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-639 | The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-69347 is a medium severity Insecure Direct Object References (IDOR) vulnerability in the WordPress WPSubscription Plugin versions up to and including 1.8.10.
This vulnerability allows attackers to bypass authorization and authentication controls by exploiting incorrectly configured access control security levels.
As a result, attackers can gain unauthorized access to sensitive files, folders, or database interactions without needing special privileges beyond those of a customer or developer.
The issue falls under the OWASP Top 10 category A1: Broken Access Control.
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized access to sensitive data or resources within the WPSubscription plugin environment.
Attackers exploiting this flaw could access files, folders, or database information that should be protected, potentially compromising the confidentiality and integrity of your data.
Because the vulnerability requires no special privileges beyond those of a customer or developer, it can be exploited relatively easily, increasing the risk of mass exploitation campaigns.
This could result in data breaches, unauthorized modifications, or other security incidents affecting your WordPress site.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability is an Insecure Direct Object References (IDOR) issue in the WPSubscription WordPress plugin up to version 1.8.10, allowing unauthorized access by bypassing authorization controls.
Detection typically involves monitoring for unauthorized access attempts to sensitive files, folders, or database interactions related to the WPSubscription plugin.
Patchstack provides mitigation rules and tools to help detect and block attacks targeting this vulnerability, but no specific commands are detailed in the provided resources.
To detect exploitation attempts, you can monitor web server logs for unusual requests to WPSubscription plugin endpoints or attempts to access resources without proper authorization.
What immediate steps should I take to mitigate this vulnerability?
The primary immediate step to mitigate this vulnerability is to update the WPSubscription plugin to version 1.8.11 or later, where the issue has been patched.
Until the update can be applied, users are advised to implement Patchstack's mitigation rules to block attacks targeting this vulnerability.
Additionally, enabling automatic updates and using rapid mitigation services offered by Patchstack can help protect your WordPress installation from exploitation.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
CVE-2025-69347 is an authorization bypass vulnerability that allows attackers to gain unauthorized access to sensitive files, folders, or database interactions. Such unauthorized access can lead to exposure or compromise of personal or sensitive data.
This type of vulnerability can negatively impact compliance with common standards and regulations like GDPR and HIPAA, which require strict access controls and protection of sensitive data. Failure to properly restrict access could result in data breaches, leading to regulatory penalties and loss of trust.
Therefore, organizations using the affected WPSubscription plugin versions should promptly apply the patch to maintain compliance with these regulations by ensuring proper access control and data protection.