CVE-2025-31618: 
WordPress vulnerability analysis and mitigation

A Missing Authorization vulnerability (CVE-2025-31618) was discovered in the Jaap Jansma Connector to CiviCRM with CiviMcRestFace WordPress plugin, affecting versions through 1.0.9. The vulnerability was disclosed on March 31, 2025, and involves broken access control issues that could allow unauthorized access to certain functionalities (Patchstack, NVD).

The vulnerability is classified as CWE-862 (Missing Authorization) with a CVSS v3.1 Base Score of 5.3 (Medium), using the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. The issue stems from improper implementation of access control security levels, potentially allowing unauthorized users to execute privileged actions (NVD, Patchstack).

The vulnerability has been assessed as having a low severity impact, primarily affecting the integrity of the system through potential unauthorized access to privileged functions. The CVSS scoring indicates that while the vulnerability can be exploited remotely, it only results in limited impact to system integrity (Patchstack).

As of the disclosure date, no official fix is available for this vulnerability. The issue affects versions through 1.0.9 of the Connector to CiviCRM with CiviMcRestFace plugin (Patchstack).