CVE-2025-30543: 
WordPress vulnerability analysis and mitigation

Missing Authorization vulnerability was discovered in Menu Duplicator WordPress plugin affecting versions through 1.0. The vulnerability allows exploiting incorrectly configured access control security levels (NVD, Patchstack).

The vulnerability is classified as a broken access control issue (CWE-862) with a CVSS v3.1 base score of 4.3 (Medium). The vulnerability stems from a missing authorization, authentication or nonce token check in a function that could allow an unprivileged user to execute certain higher privileged actions (Patchstack).

The vulnerability allows unprivileged users to perform actions that should be restricted to users with higher privileges. While rated as low severity, it represents a security risk through broken access control mechanisms (Patchstack).

The vulnerability requires an authenticated user with subscriber-level access to exploit. It was discovered by Nabil Irawan and published on March 24, 2025 (Patchstack).

Currently, there is no official fix available for this vulnerability. Given the low severity impact, the vulnerability is unlikely to be exploited, but website administrators should consider implementing additional access controls or authentication mechanisms (Patchstack).