CVE-2025-30960: 
WordPress vulnerability analysis and mitigation

A Missing Authorization vulnerability (CVE-2025-30960) was discovered in the WordPress FS Poster plugin affecting versions through 6.5.8. The vulnerability was disclosed on April 15, 2025, and was reported by Rafie Muhammad through Patchstack (Patchstack Database).

The vulnerability is classified as a Broken Access Control issue (CWE-862) with a CVSS v3.1 Base Score of 8.3 (High). The vulnerability vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H, indicating network accessibility, low attack complexity, low privileges required, no user interaction needed, and potential for high impact on integrity and availability with low confidentiality impact (Patchstack Database).

The vulnerability allows an unprivileged user with subscriber-level access to execute higher privileged actions, potentially leading to site-wide broken access control. This is considered highly dangerous and is expected to become mass exploited (Patchstack Database).

The vulnerability requires subscriber-level privileges to exploit, making it accessible to authenticated users with minimal access rights. The low attack complexity and network vector make it particularly concerning for potential exploitation (Patchstack Database).

Users are advised to update to version 7.1.8 or later to resolve the vulnerability. Patchstack has issued a virtual patch to mitigate this issue by blocking potential attacks until users can update to the fixed version (Patchstack Database).