CVE-2025-13496: 
WordPress vulnerability analysis and mitigation

CVE-2025-13496 is a missing authorization vulnerability in the Moosend Landing Pages plugin for WordPress that allows authenticated attackers with Subscriber-level access or above to delete the moosend_landing_api_key option value. The flaw affects all versions of the plugin up to and including 1.1.6, and was disclosed on January 7, 2026. It carries a CVSS v3.1 base score of 5.3 (Medium), assigned by Wordfence (Wordfence, Red Hat CVE).

The vulnerability is classified as CWE-862 (Missing Authorization) and stems from the absence of a capability check in the moosend_landings_auth_get function within forms/auth-request.php. Because no privilege verification is performed before executing the function, any authenticated WordPress user — including those with the lowest default role (Subscriber) — can trigger the deletion of the moosend_landing_api_key WordPress option. The vulnerable code path is publicly visible in the plugin's Trac repository (WordPress Trac, Wordfence).

Successful exploitation allows an authenticated attacker to delete the Moosend API key stored in the WordPress options table, effectively severing the site's integration with the Moosend email marketing and landing page service. This results in a loss of integrity for the plugin's configuration and disruption of landing page functionality, though there is no direct confidentiality or availability impact on the underlying WordPress installation. The scope is limited to the plugin's operational data and does not enable remote code execution or access to sensitive user data (Wordfence).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-13496. The EPSS score is approximately 0.026%, indicating a very low probability of exploitation in the near term. The vulnerability requires at minimum a valid Subscriber-level WordPress account, which limits opportunistic exploitation. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Wordfence, Red Hat CVE).

1. Reconnaissance: Identify WordPress sites running the Moosend Landing Pages plugin version 1.1.6 or earlier, using tools like WPScan or by inspecting publicly accessible plugin metadata.
2. Obtain authenticated access: Register or log in as a Subscriber-level (or higher) WordPress user on the target site.
3. Trigger the vulnerable function: Send an authenticated HTTP request to the WordPress AJAX endpoint or the route that invokes moosend_landings_auth_get in forms/auth-request.php, without any additional authorization parameters required.
4. Delete the API key: The function executes without a capability check, deleting the moosend_landing_api_key option from the WordPress database, disabling the Moosend integration on the target site (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing authenticated POST requests to the endpoint invoking moosend_landings_auth_get from low-privilege user accounts; repeated or anomalous requests from Subscriber-level accounts to plugin-related AJAX actions.
• Database: Absence or unexpected deletion of the moosend_landing_api_key entry in the WordPress wp_options table.
• Application Behavior: Moosend Landing Pages plugin losing its API key configuration, resulting in broken landing page integrations or plugin error messages indicating missing API credentials.

Users should update the Moosend Landing Pages plugin to version 1.1.7 or later, which addresses the missing capability check. As a temporary workaround, site administrators can restrict user registration or limit Subscriber-level account creation to reduce the attack surface. Reviewing WordPress user accounts for unauthorized Subscriber-level registrations is also advisable (Wordfence).