CVE-2025-31524: 
WordPress vulnerability analysis and mitigation

CVE-2025-31524 is an Incorrect Privilege Assignment vulnerability affecting the WordPress WP User Profiles plugin through version 2.6.2. The vulnerability was discovered by researcher astra.r3verii and was publicly disclosed on April 8, 2025 (Patchstack).

The vulnerability has been assigned a CVSS v3.1 base score of 8.8 (High) with the following vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The vulnerability is classified as CWE-266 (Incorrect Privilege Assignment) and requires Subscriber-level privileges to exploit (NVD).

This vulnerability could allow a malicious actor to escalate their low privileged account to one with higher privileges. If successful, an attacker could potentially gain full control of the website if high privileges are obtained (Patchstack).

The vulnerability is considered highly dangerous and is expected to become mass exploited. It requires only Subscriber-level access to exploit, making it relatively accessible to attackers (Patchstack).

Currently, no official fix is available for this vulnerability. Patchstack has issued a virtual patch to mitigate the issue by blocking potential attacks until an official fix becomes available (Patchstack).