CVE-2025-49971: 
WordPress vulnerability analysis and mitigation

CVE-2025-49971 is a Missing Authorization (Broken Access Control) vulnerability in the eDS Responsive Menu WordPress plugin by aThemeArt Translations. It affects all versions up to and including 1.2, allowing authenticated users with low privileges (Subscriber level) to exploit incorrectly configured access control security levels. The vulnerability was reported on May 16, 2025, and published on June 19–20, 2025, with no official patch available at time of disclosure. It carries a CVSS v3.1 base score of 4.3 (Medium) (Patchstack, Feedly).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the plugin fails to perform adequate authorization checks before executing certain privileged actions. An authenticated attacker with Subscriber-level access can invoke functionality intended for higher-privileged roles (e.g., administrators) due to absent or improperly configured nonce token or capability checks. The attack vector is network-based, requires low privileges, no user interaction, and low attack complexity, making it straightforward to exploit for any authenticated WordPress user (Patchstack, Feedly).

Successful exploitation results in a low confidentiality impact with no integrity or availability impact, as reflected in the CVSS score. An authenticated low-privileged user (Subscriber) could access or trigger restricted plugin functionality not intended for their role. While the immediate impact is limited, such broken access control issues can be chained with other vulnerabilities or used in mass-exploit campaigns targeting WordPress sites at scale (Patchstack).

The EPSS score is approximately 0.028% (0.000280), indicating a low probability of exploitation in the near term. No public proof-of-concept exploit code or in-the-wild exploitation has been reported. The vulnerability requires at minimum a Subscriber-level account on the target WordPress site. Patchstack notes that vulnerabilities of this class are sometimes used in mass-exploit campaigns against WordPress sites regardless of their size or traffic (Patchstack, Feedly). It is not listed in the CISA KEV catalog.

As of the disclosure date (June 19–20, 2025), no official patch is available for the eDS Responsive Menu plugin (versions ≤ 1.2). Site administrators should consider deactivating and removing the plugin until a patched version is released. Restricting user registration or limiting Subscriber-level accounts on the WordPress site can reduce exposure. Monitoring for unexpected plugin-related actions in WordPress audit logs is also advisable (Patchstack).

The vulnerability was covered in the Wordfence Intelligence Weekly WordPress Vulnerability Report for June 16–22, 2025, as part of a broader roundup of WordPress plugin issues. Patchstack, which discovered and published the vulnerability (credited to researcher Mika), classifies it as low priority with unlikely exploitation impact. No significant broader media coverage or notable researcher commentary beyond these standard disclosure channels has been identified (Wordfence, Patchstack).