CVE-2025-30636: 
WordPress vulnerability analysis and mitigation

The CVE-2025-30636 is a Missing Authorization vulnerability discovered in the Ability, Inc Accessibility Suite, affecting versions through 4.19. The vulnerability was disclosed on June 6, 2025, and is related to incorrectly configured access control security levels (NVD, Patchstack).

The vulnerability has been assigned a CVSS v3.1 Base Score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L. It is classified under CWE-862 (Missing Authorization) and represents a broken access control issue where unprivileged users could potentially execute higher privileged actions (Patchstack).

The vulnerability allows unauthorized access to higher privileged functions, potentially compromising the security of the affected systems. The impact is considered low to medium severity, with potential implications for both integrity and availability of the system (Patchstack).

The vulnerability requires a low level of access privileges (Subscriber level) to exploit, with network-based attack vectors being possible. The attack complexity is considered low, indicating relatively straightforward exploitation methods (Patchstack).

As of the disclosure date, no official fix has been made available for this vulnerability. The issue affects all versions up to and including 4.19 of the Accessibility Suite (Patchstack).