CVE-2025-49880: 
WordPress vulnerability analysis and mitigation

A Missing Authorization vulnerability (CVE-2025-49880) was discovered in the CubeWP Forms WordPress plugin affecting versions through 1.1.5. The vulnerability was disclosed on June 12, 2025, and allows exploiting incorrectly configured access control security levels (Wiz, Patchstack).

The vulnerability is classified as a broken access control issue (CWE-862), which stems from missing authorization, authentication, or nonce token checks in certain functions. This allows unprivileged users to execute higher privileged actions. The vulnerability has been assigned a CVSS v3.1 Base Score of 4.3 (Medium) (Patchstack, NVD).

The security issue has been assessed as having a low severity impact and is considered unlikely to be exploited. The vulnerability could potentially allow subscriber-level users to perform unauthorized actions (Patchstack).

The vulnerability requires a subscriber-level user account to exploit, and no public exploits have been reported. The issue is considered to have a low likelihood of exploitation (Patchstack).

The vulnerability has been fixed in version 1.1.6 of the CubeWP Forms plugin. Users are advised to update to version 1.1.6 or later to remove the vulnerability. Patchstack users can enable auto-update for vulnerable plugins (Patchstack).