CVE-2025-48271: 
WordPress vulnerability analysis and mitigation

Missing Authorization vulnerability discovered in Leadinfo plugin affecting versions through 1.1, disclosed on May 23, 2025. The vulnerability allows exploiting incorrectly configured access control security levels in the WordPress plugin (Patchstack).

The vulnerability has been assigned a CVSS v3.1 base score of 6.5 (Medium), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. The issue is classified under CWE-862 (Missing Authorization) and requires no authentication to exploit. The vulnerability allows unauthenticated attackers to modify settings in the plugin (NVD, Patchstack).

The vulnerability allows attackers to change settings within the plugin without proper authorization. This could potentially lead to integrity and availability issues in affected WordPress installations (Patchstack).

The vulnerability is considered moderately dangerous and is expected to become exploited. It requires no authentication and can be triggered remotely, making it relatively easy to exploit (Patchstack).

Users are advised to update to version 2.1 or later which contains the fix for this vulnerability. For users unable to update immediately, Patchstack has issued a virtual patch to mitigate this issue by blocking potential attacks (Patchstack).