CVE-2025-39561: 
WordPress vulnerability analysis and mitigation

CVE-2025-39561 is a Missing Authorization (Broken Access Control) vulnerability in the LoginWP - Pro WordPress plugin developed by Marketing Fire, LLC. It allows unauthenticated remote attackers to access functionality not properly constrained by access control lists (ACLs), classified under OWASP Top 10 A1: Broken Access Control. The vulnerability affects LoginWP - Pro versions up to and including 4.0.8.5, with version 4.0.8.6 containing the fix. It was reported by Rafie Muhammad on December 13, 2024, and publicly disclosed on January 5, 2026, with a CVSS v3.1 base score of 6.5 (Medium) (Patchstack).

The vulnerability is rooted in a missing authorization check (CWE-862) within the LoginWP - Pro plugin, where one or more plugin functions fail to verify whether the requesting user has the appropriate permissions before executing privileged actions. This is consistent with a missing nonce token or capability check on a WordPress AJAX handler or admin endpoint. The attack vector is network-based, requires no authentication, no user interaction, and low attack complexity, meaning any unauthenticated remote attacker can trigger the vulnerable functionality directly. No public proof-of-concept code has been identified at this time (Patchstack).

Successful exploitation allows an unauthenticated attacker to perform actions that should be restricted to privileged users, resulting in low integrity and low availability impacts with no confidentiality impact per the CVSS assessment. In practice, this could allow attackers to modify plugin settings, manipulate login redirect rules, or disrupt authentication workflows on affected WordPress sites. Patchstack notes that vulnerabilities of this type are commonly used in mass-exploit campaigns targeting thousands of WordPress sites regardless of their traffic or popularity (Patchstack).

No active in-the-wild exploitation has been confirmed, and no public exploit code is known at this time. The EPSS score is approximately 0.038%, indicating a low but non-negligible probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack classifies it as medium priority and warns it is expected to be exploited, particularly in automated mass-exploit campaigns targeting WordPress plugins (Patchstack).

1. Reconnaissance: Identify WordPress sites running the LoginWP - Pro plugin (versions ≤ 4.0.8.5) using tools like WPScan, Shodan, or by checking publicly accessible readme files at /wp-content/plugins/loginwp-pro/readme.txt.
2. Identify vulnerable endpoint: Enumerate WordPress AJAX endpoints or admin-accessible actions registered by the plugin that lack proper authorization checks (e.g., wp-admin/admin-ajax.php with specific action parameters).
3. Craft unauthenticated request: Send an HTTP POST or GET request to the identified endpoint without authentication credentials or a valid nonce, invoking the privileged functionality directly.
4. Achieve unauthorized action: Depending on the specific unprotected function, the attacker may be able to modify plugin configuration (e.g., login redirect rules), alter site behavior, or cause disruption to authentication workflows (Patchstack).

• Network: Unusual unauthenticated POST requests to wp-admin/admin-ajax.php with action parameters associated with the LoginWP - Pro plugin; repeated requests from a single IP or distributed IPs targeting the same endpoint.
• Logs: WordPress access logs showing requests to plugin-specific AJAX actions without valid authentication cookies or nonce values; HTTP 200 responses to requests that should require authentication.
• File System: Unexpected changes to LoginWP - Pro plugin configuration files or WordPress options table entries related to login redirect rules.
• Application: Unexplained changes to login redirect settings or plugin behavior that were not made by an authenticated administrator.

The primary remediation is to update LoginWP - Pro to version 4.0.8.6 or later, which contains the fix for this vulnerability. Site administrators unable to update immediately should consider using Patchstack's virtual patching (mitigation rule) to block exploitation attempts until the plugin can be updated. As a general hardening measure, restrict access to WordPress admin endpoints using IP allowlisting or a web application firewall (WAF) (Patchstack).