CVE-2025-52775: 
WordPress vulnerability analysis and mitigation

CVE-2025-52775 is a Missing Authorization vulnerability in the Project Cost Calculator WordPress plugin by Ronik@UnlimitedWP, classified under CWE-862. It allows authenticated attackers to exploit incorrectly configured access control security levels. All versions up to and including 1.0.0 are affected. The vulnerability was published on August 14, 2025, and carries a CVSS v3.1 base score of 7.1 (High) (Feedly, Patchstack).

The root cause is a Missing Authorization flaw (CWE-862), meaning the plugin fails to properly verify whether a requesting user has the appropriate permissions before executing sensitive actions. This falls under the broader category of Broken Access Control, where plugin endpoints or AJAX handlers can be invoked by lower-privileged authenticated users who should not have access. The attack vector is network-based, requires low privileges (authenticated user), and no user interaction, making it straightforward to exploit once an attacker has any valid WordPress account (Feedly, Patchstack).

Successful exploitation can result in unauthorized modification of plugin data or settings (integrity impact: Low) and potential disruption of availability (availability impact: High), such as deletion or corruption of cost calculator configurations. There is no direct confidentiality impact based on the CVSS vector. The scope is limited to the affected WordPress installation, but availability disruption could render the plugin or associated site functionality inoperable (Feedly).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the disclosure date. The EPSS score is approximately 0.036% (0.000360), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The vulnerability was assigned and disclosed by Patchstack (Feedly, Patchstack).

Users should update the Project Cost Calculator plugin beyond version 1.0.0 as soon as a patched release is made available by Ronik@UnlimitedWP. In the interim, site administrators should consider deactivating or removing the plugin if it is not critical to operations, or restricting access to the WordPress admin area to trusted IP addresses. Monitoring WordPress user activity logs for unexpected actions related to the plugin's functionality is also advisable (Patchstack).