CVE-2025-49906: 
WordPress vulnerability analysis and mitigation

CVE-2025-49906 is a Missing Authorization (Broken Access Control) vulnerability in the StellarWP WPComplete WordPress plugin that allows unauthenticated attackers to access functionality not properly constrained by ACLs. It affects WPComplete versions up to and including 2.9.5.3, with version 2.9.5.4 containing the fix. The vulnerability was reported by researcher Nabil Irawan on September 24, 2025, and publicly disclosed on October 22–24, 2025. It carries a CVSS v3.1 base score of 5.3 (Medium), assigned by Patchstack (Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the plugin fails to perform adequate authorization checks before allowing access to certain functionality. This allows unauthenticated network-based attackers to invoke restricted plugin functions without proper privilege verification — a pattern consistent with missing nonce token or capability checks in WordPress plugin code. No authentication or user interaction is required, and attack complexity is low. No public proof-of-concept code or detailed technical write-up has been published at this time (Patchstack).

Successful exploitation results in a limited availability impact (CVSS availability impact: Low), with no confidentiality or integrity impact according to the CNA-assigned vector. An unauthenticated attacker could invoke plugin functionality that should be restricted, potentially disrupting course completion tracking or related features managed by WPComplete. The overall impact is assessed as low severity and is considered unlikely to be exploited for significant harm (Patchstack).

No known public exploit code or active in-the-wild exploitation has been reported for CVE-2025-49906. The EPSS score is approximately 0.028% (0.000280), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class can be used in mass-exploit campaigns targeting WordPress sites at scale, though this specific issue is rated low priority (Patchstack).

The vulnerability is resolved in WPComplete version 2.9.5.4, released by Liquid Web / StellarWP. Site administrators should update the WPComplete plugin to version 2.9.5.4 or later immediately via the WordPress admin dashboard or their hosting provider. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard. No configuration-based workaround has been published; updating to the patched version is the only recommended remediation (Patchstack).

The vulnerability was included in Wordfence's weekly WordPress vulnerability report for October 20–26, 2025, indicating routine tracking by the WordPress security community (Wordfence). No significant vendor statements, researcher commentary, or broader media coverage have been identified beyond standard vulnerability database listings.