CVE-2025-13091: 
WordPress vulnerability analysis and mitigation

CVE-2025-13091 is a missing capability check vulnerability in the Shopire theme for WordPress that allows authenticated attackers with Subscriber-level access or above to install the 'fable-extra' plugin without authorization. It affects all versions of the Shopire theme up to and including 1.0.57. The vulnerability was published on February 19, 2026, and carries a CVSS v3.1 base score of 4.3 (Medium) (Red Hat CVE).

The root cause is a missing capability check (CWE-15: External Control of System or Configuration Setting) on the shopire_admin_install_plugin() function within the Shopire WordPress theme. Because no authorization check is enforced before executing this function, any authenticated user — including those with the lowest default role (Subscriber) — can trigger plugin installation via a network request. The attack requires no user interaction and has low attack complexity, making it straightforward to exploit once an attacker has any valid WordPress account on the target site (Red Hat CVE).

Successful exploitation allows an attacker to install the 'fable-extra' plugin on the affected WordPress site without administrative authorization, resulting in unauthorized modification of site configuration and data. While confidentiality and availability are not directly impacted, the integrity impact could be significant if the installed plugin introduces additional attack surface, backdoors, or malicious functionality. This could serve as a stepping stone for privilege escalation or further compromise of the WordPress environment.

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.034%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum a valid Subscriber-level account on the target WordPress site (Red Hat CVE).

1. Reconnaissance: Identify WordPress sites using the Shopire theme at version 1.0.57 or earlier, using tools like WPScan or manual inspection of theme metadata.
2. Obtain credentials: Register or obtain a Subscriber-level (or higher) account on the target WordPress site — this may be possible if user registration is open.
3. Authenticate: Log in to the WordPress site with the low-privileged account to obtain a valid session cookie or nonce.
4. Trigger vulnerable function: Send an authenticated HTTP request to the WordPress admin AJAX endpoint (e.g., wp-admin/admin-ajax.php) invoking the shopire_admin_install_plugin() function, bypassing any expected capability checks.
5. Plugin installed: The 'fable-extra' plugin is installed on the site without administrator approval, potentially enabling further exploitation depending on that plugin's functionality.

• Logs: WordPress access logs showing authenticated POST requests to wp-admin/admin-ajax.php with actions related to plugin installation from low-privileged user accounts; unexpected plugin installation events in WordPress activity logs.
• File System: Presence of the 'fable-extra' plugin directory under wp-content/plugins/fable-extra/ when not intentionally installed by an administrator.
• WordPress Admin: Plugin list showing 'fable-extra' as installed without a corresponding administrator action in audit logs.

WordPress site administrators should update the Shopire theme to a version beyond 1.0.57 that includes a proper capability check on the shopire_admin_install_plugin() function. Until a patched version is available, administrators should restrict user registration to prevent untrusted Subscriber-level accounts, or temporarily disable the Shopire theme and switch to an alternative. Monitoring WordPress plugin installation events and reviewing user roles can help detect unauthorized activity (Red Hat CVE).