CVE-2025-15157: 
WordPress vulnerability analysis and mitigation

CVE-2025-15157 is a missing authorization vulnerability in the Starfish Review Generation & Marketing for WordPress plugin that allows authenticated attackers to escalate privileges to administrator level. The flaw exists in all versions up to and including 3.1.19, affecting the srm_restore_options_defaults function. It was published on February 13, 2026, and carries a CVSS v3.1 base score of 8.8 (High) (Red Hat CVE, Wordfence).

The root cause is a missing capability check (CWE-862) on the srm_restore_options_defaults function within the Starfish Review Generation & Marketing plugin. Because no authorization check is enforced before executing this function, any authenticated user with Subscriber-level access or higher can invoke it to update arbitrary WordPress site options. An attacker can exploit this by modifying the default_role option to administrator and enabling open user registration (users_can_register), effectively creating a self-registration pathway to full admin access (Red Hat CVE, CIRCL Vulnerability DB).

Successful exploitation results in complete compromise of the affected WordPress installation, with high confidentiality, integrity, and availability impacts. An attacker who gains administrator access can install malicious plugins, exfiltrate sensitive data, deface the site, create backdoors, or pivot to underlying server infrastructure. All sites running the plugin at version 3.1.19 or earlier with at least one registered user account (or open registration) are at risk (Red Hat CVE, Wordfence).

As of the time of reporting, no public proof-of-concept exploit code has been identified and there is no evidence of active in-the-wild exploitation. The EPSS score is approximately 0.014% (0.000140), indicating a currently low probability of exploitation in the near term. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. It is detected by Qualys scanner (detection ID 530968) (Red Hat CVE, CIRCL Vulnerability DB).

1. Reconnaissance: Identify WordPress sites running the Starfish Review Generation & Marketing plugin (version ≤ 3.1.19) using tools like WPScan or by checking publicly accessible plugin metadata at /wp-content/plugins/starfish-reviews/readme.txt.
2. Obtain Subscriber-level access: Register a standard user account on the target site (if registration is open), or use compromised low-privilege credentials.
3. Trigger the vulnerable function: Send an authenticated HTTP POST request to the WordPress admin-ajax endpoint (e.g., wp-admin/admin-ajax.php) invoking the srm_restore_options_defaults action, which lacks a capability check.
4. Modify WordPress options: Craft the request to update the default_role WordPress option to administrator and set users_can_register to 1, enabling open registration with admin as the default role.
5. Register an administrator account: Log out and register a new user account via the standard WordPress registration page (/wp-login.php?action=register), which will now be created with administrator privileges.
6. Achieve full site compromise: Log in with the newly created administrator account to gain complete control of the WordPress installation (Red Hat CVE, CIRCL Vulnerability DB).

• Logs: WordPress access logs showing POST requests to wp-admin/admin-ajax.php with the action=srm_restore_options_defaults parameter from low-privilege user sessions; unexpected new administrator accounts in wp_users with recent creation timestamps.
• Database: Changes to wp_options table entries for default_role (set to administrator) and users_can_register (set to 1) at unexpected times.
• File System: New or modified plugin/theme files, unexpected PHP files in the uploads directory, or newly installed plugins/themes following the creation of unauthorized admin accounts.
• Network: Unusual authenticated POST requests to the WordPress AJAX endpoint from subscriber-level sessions, particularly targeting the srm_restore_options_defaults action.

No patch has been confirmed available for the Starfish Review Generation & Marketing plugin as of the disclosure date; site administrators should immediately deactivate and uninstall the plugin (version 3.1.19 and earlier) if it is in use. As a workaround, disable user registration (Settings > General > Membership) and audit existing user accounts for unauthorized administrator-level accounts. Review the wp_options table for unexpected changes to default_role and users_can_register. Consider replacing the plugin with an actively maintained alternative that implements proper capability checks (Red Hat CVE, Wordfence).

Wordfence included CVE-2025-15157 in its weekly WordPress vulnerability report for February 9–15, 2026, flagging it as a notable privilege escalation risk for WordPress site operators (Wordfence). RedPacket Security also published an alert and shared it on social media, contributing to broader community awareness (RedPacket Security). No significant vendor statement from the plugin author has been publicly identified.