CVE-2025-49913: 
WordPress vulnerability analysis and mitigation

A Missing Authorization vulnerability (CVE-2025-49913) was discovered in CoSchedule WordPress plugin (coschedule-by-todaymade) versions through 3.4.0. The vulnerability was disclosed on October 22, 2025, and allows exploitation of incorrectly configured access control security levels (NVD).

The vulnerability has been assigned a CVSS v3.1 Base Score of 5.3 (Medium) with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. This indicates that the vulnerability can be exploited over the network, requires low attack complexity, needs no privileges or user interaction, has unchanged scope, and can impact confidentiality at a low level while having no impact on integrity or availability (AttackerKB).

The vulnerability primarily affects the confidentiality of the system, with a low impact score of 1.4. The attack can be executed remotely without requiring any special privileges or user interaction, potentially exposing sensitive information (AttackerKB).

The vulnerability has a high exploitability score of 3.9, primarily due to its network-based attack vector, low attack complexity, and no requirements for privileges or user interaction (AttackerKB).