CVE-2025-49986: 
WordPress vulnerability analysis and mitigation

CVE-2025-49986 is a Missing Authorization (Broken Access Control) vulnerability in the Video List Manager WordPress plugin by thanhtungtnt. It allows unauthenticated network-based attackers to access functionality not properly constrained by access control lists (ACLs), resulting in unauthorized integrity impact. All versions up to and including 1.7 are affected. The vulnerability was published on June 20, 2025, and carries a CVSS v3.1 base score of 5.3 (Medium) (Feedly, Wordfence).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to verify whether a requesting user has the appropriate permissions before executing certain privileged actions. An unauthenticated remote attacker can send crafted network requests to trigger restricted plugin functionality without any authentication or elevated privileges. No user interaction is required, and attack complexity is low, making this straightforward to exploit against any unpatched installation (Feedly).

Successful exploitation allows an unauthenticated attacker to perform unauthorized actions within the Video List Manager plugin, resulting in a low integrity impact (e.g., modifying plugin data or settings). Confidentiality and availability are not directly impacted according to the CVSS assessment. The scope is limited to the affected plugin's functionality and does not extend to the broader WordPress installation or host system (Feedly).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-49986 as of the available data. The EPSS score is approximately 0.037%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The low barrier to exploitation (no authentication, no user interaction required) does increase theoretical risk for unpatched sites (Feedly).

Users should update the Video List Manager WordPress plugin to a version beyond 1.7 if a patched release becomes available from the plugin author (thanhtungtnt). If no patch is available, the recommended workaround is to deactivate and remove the plugin until a fix is released. Site administrators should also review WordPress user roles and restrict access to plugin management pages where possible (Wordfence, Patchstack).

The vulnerability was included in Wordfence's weekly WordPress vulnerability report for the period of June 16–22, 2025, indicating routine tracking by the WordPress security community. No notable researcher commentary or significant media coverage beyond standard vulnerability database listings has been identified (Wordfence).