CVE-2025-48260: 
WordPress vulnerability analysis and mitigation

A Missing Authorization vulnerability was discovered in Ninja Team GDPR CCPA Compliance Support plugin versions up to 2.7.3. The vulnerability was disclosed on May 19, 2025, and was assigned CVE-2025-48260. This security issue affects the WordPress plugin's access control security levels (Patchstack).

The vulnerability is classified as a Broken Access Control issue (CWE-862) with a CVSS v3.1 Base Score of 4.3 (Medium). The vulnerability vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, indicating network accessibility, low attack complexity, and required low privileges. The vulnerability requires Subscriber-level privileges to exploit (Patchstack).

The vulnerability allows unprivileged users to execute certain higher privileged actions due to missing authorization, authentication, or nonce token checks. While classified as low severity, it could potentially lead to unauthorized access to privileged functions (Patchstack).

The vulnerability has been assessed as having low exploitation potential. It requires an attacker to have Subscriber-level access to the WordPress installation. The issue was initially reported on April 30, 2025, by researcher Cút lộn xào me (Patchstack).

The vulnerability has been fixed in version 2.7.4 of the GDPR CCPA Compliance Support plugin. Users are advised to update to version 2.7.4 or later to remove the vulnerability. Patchstack users can enable auto-update for vulnerable plugins (Patchstack).