CVE-2025-49293: 
WordPress vulnerability analysis and mitigation

A Missing Authorization vulnerability (CVE-2025-49293) was discovered in CodeRevolution's Crawlomatic Multisite Scraper Post Generator WordPress plugin, affecting versions up to 2.6.8.2. The vulnerability was publicly disclosed on June 5, 2025, and involves broken access control issues that could allow unprivileged users to execute higher privileged actions (Patchstack).

The vulnerability is classified as a Missing Authorization (CWE-862) issue with a CVSS v3.1 Base Score of 4.3 (Medium), using the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. The security flaw stems from incorrectly configured access control security levels that could allow unauthorized actions (NVD).

The vulnerability allows exploiting incorrectly configured access control security levels, potentially enabling subscriber-level users to perform actions beyond their intended privileges. The CVSS score of 4.3 indicates a medium severity impact with potential for unauthorized modifications (Patchstack).

The vulnerability has been patched in version 2.6.9 of the Crawlomatic Multisite Scraper Post Generator plugin. Users are advised to update to this version or later to resolve the security issue (Patchstack).