CVE-2025-30929: 
WordPress vulnerability analysis and mitigation

CVE-2025-30929 is a Missing Authorization (Broken Access Control) vulnerability in the WordPress plugin fluXtore by amazewp, affecting all versions up to and including 1.6.0. The flaw allows unauthenticated network-based attackers to exploit incorrectly configured access control security levels, potentially performing actions beyond their privilege level. It was reported by researcher Martino Spagnuolo (r3verii) on June 4, 2025, and publicly disclosed by Patchstack on July 4, 2025. The vulnerability carries a CVSS v3.1 base score of 5.3 (Medium) (Patchstack, Red Hat CVE).

The root cause is classified as CWE-862 (Missing Authorization), meaning one or more plugin functions lack proper authorization, authentication, or nonce token checks before executing privileged actions. This allows an unauthenticated remote attacker to invoke restricted functionality by sending crafted HTTP requests directly to the vulnerable endpoints, bypassing WordPress's standard capability checks. The attack vector is network-based, requires no user interaction, and has low attack complexity, making it accessible to unsophisticated attackers (Patchstack).

Successful exploitation allows unauthenticated attackers to perform unauthorized actions within the fluXtore plugin, resulting in a low integrity impact with no direct confidentiality or availability impact per the CVSS scoring. While the individual impact is limited, Patchstack notes that vulnerabilities of this class are frequently used in mass-exploit campaigns targeting thousands of WordPress sites simultaneously, regardless of site size or popularity. The practical risk includes unauthorized modification of plugin-controlled data or settings on affected WordPress installations (Patchstack).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for CVE-2025-30929. The EPSS score is approximately 0.028% (0.000280), indicating a very low probability of exploitation in the near term. Patchstack classifies this as low priority with no impactful threat, and it is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Patchstack, Red Hat CVE).

The vendor has released a patched version of the fluXtore plugin; users should update to version 1.6.3 or later to remediate the vulnerability. No specific configuration-based workaround has been published — updating the plugin is the recommended and only confirmed fix. Patchstack users can enable auto-update for vulnerable plugins to receive protection automatically (Patchstack).

Patchstack, which discovered and disclosed the vulnerability, classifies it as low priority with unlikely exploitation impact. No notable vendor statements beyond the patch release, significant researcher commentary, or major media coverage have been identified for this vulnerability.