CVE-2025-49338: 
WordPress vulnerability analysis and mitigation

CVE-2025-49338 is a Missing Authorization (Broken Access Control) vulnerability in the Flowbox WordPress plugin that allows unauthenticated network attackers to perform unauthorized data modification actions. It affects Flowbox plugin versions up to and including 1.1.6. The vulnerability was reported by Muhammad Nur Ibnu Hubab on October 16, 2025, and publicly disclosed by Patchstack on December 31, 2025. It carries a CVSS v3.1 base score of 5.3 (Medium), assigned by Patchstack (Patchstack).

The root cause is classified as CWE-862 (Missing Authorization), meaning one or more plugin functions lack proper authorization, authentication, or nonce token checks before executing privileged actions. This allows an unauthenticated remote attacker to invoke these functions over the network with low attack complexity and no user interaction required. The vulnerability falls under OWASP Top 10 category A1: Broken Access Control, and exploitation involves sending crafted network requests to the vulnerable plugin endpoints to trigger actions that should be restricted to privileged users (Patchstack).

Successful exploitation results in a limited integrity impact — unauthenticated attackers can modify data or trigger privileged plugin actions without authorization. There is no confidentiality or availability impact based on the CVSS assessment. The scope is limited to the affected WordPress installation, and there is no evidence of lateral movement potential or significant data exposure risk beyond unauthorized data modification (Patchstack).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.028% (0.000280), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack classifies it as low priority with unlikely exploitation impact, though it notes that broken access control vulnerabilities of this type are sometimes used in mass-exploit campaigns targeting WordPress plugins at scale (Patchstack).

As of the time of disclosure, no official patch has been released by the Flowbox plugin developer. Patchstack recommends updating the affected plugin as the immediate action; if an update is unavailable, site owners should contact their hosting provider or web developer for assistance. As a workaround, administrators can deactivate or remove the Flowbox plugin until a patched version is available. Patchstack customers received early warning protection on December 31, 2025 (Patchstack).