CVE-2025-48166: 
WordPress vulnerability analysis and mitigation

A Missing Authorization vulnerability was discovered in Bill Minozzi's Stop and Block bots plugin Anti bots (version 1.48 and earlier) for WordPress. The vulnerability was disclosed on July 16, 2025, and allows unauthorized access to functionality that should be properly constrained by Access Control Lists (ACLs) (Patchstack).

The vulnerability is classified as a Broken Access Control issue (CWE-862) with a CVSS v3.1 Base Score of 5.3 (Medium), and vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. The vulnerability stems from missing authorization checks that should restrict access to certain privileged functions (Patchstack).

The vulnerability allows unauthenticated users to execute certain higher privileged actions within the plugin. The CVSS score indicates that while the attack complexity is low and requires no privileges or user interaction, the impact is primarily limited to integrity with no direct effect on confidentiality or availability (Patchstack).

The vulnerability has been fixed in version 1.50 of the Stop and Block bots plugin Anti bots. Users are advised to update to version 1.50 or later to remediate the security issue (Patchstack).