CVE-2025-23514: 
WordPress vulnerability analysis and mitigation

A Missing Authorization vulnerability was identified in Sanjaysolutions Loginplus plugin versions through 1.2. The vulnerability was discovered by researcher Kévin Mosbahi (Mika) and was publicly disclosed on January 16, 2025. This security issue affects the WordPress plugin Loginplus and is tracked as CVE-2025-23514 (Patchstack).

The vulnerability is classified as a Broken Access Control issue (CWE-862) where there is a missing authorization, authentication, or nonce token check in a function. The vulnerability has received a CVSS v3.1 score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L (NVD, Patchstack).

The vulnerability could potentially allow an unprivileged user to execute certain higher privileged actions. The specific impact varies case by case, though it has been assessed as having a low severity impact and is considered unlikely to be exploited (Patchstack).

The vulnerability can be exploited by unauthenticated users, requiring no special privileges. The issue was initially reported on October 21, 2024, before its public disclosure in January 2025 (Patchstack).

As of January 21, 2025, no official fix is available for this vulnerability. The vulnerability is considered to have a low patch priority, and virtual patching is deemed unnecessary according to the security assessment (Patchstack).