CVE-2025-52802: 
WordPress vulnerability analysis and mitigation

CVE-2025-52802 is a Missing Authorization (Broken Access Control) vulnerability in the WordPress plugin "Import YouTube videos as WP Posts" by enguerranws. It affects all versions from n/a through 2.1, allowing unauthenticated remote attackers to exploit incorrectly configured access control security levels. The vulnerability was published on June 20, 2025, and carries a CVSS v3.1 base score of 7.5 (High) (Red Hat CVE, Wordfence).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether a requesting user has the necessary permissions before executing sensitive actions. The attack vector is network-based, requires no authentication, no user interaction, and low attack complexity, making it trivially exploitable by any remote attacker. The flaw stems from incorrectly configured access control security levels on one or more plugin endpoints or AJAX actions that should be restricted to privileged users (e.g., administrators) but are accessible without authentication (Red Hat CVE, Wordfence).

Successful exploitation results in a high integrity impact with no confidentiality or availability impact, meaning an unauthenticated attacker can perform unauthorized actions such as importing arbitrary YouTube videos as WordPress posts without proper authorization. This could allow content manipulation, spam injection, or abuse of the site's content management functions. The scope is unchanged, limiting the impact to the affected WordPress installation itself (Red Hat CVE).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-52802 as of the time of writing. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.037%, indicating a low probability of exploitation in the near term (Red Hat CVE, Wordfence).

Users of the "Import YouTube videos as WP Posts" plugin should update to a version beyond 2.1 if a patched release becomes available from the plugin author (enguerranws). If no patch is available, the recommended immediate workaround is to deactivate and remove the plugin until a fix is released. Site administrators should also review WordPress user roles and restrict access to plugin functionality where possible (Wordfence).

The vulnerability was included in Wordfence's weekly WordPress vulnerability report for the period of June 16–22, 2025, indicating routine tracking by the WordPress security community. No notable vendor statements, researcher commentary, or significant media coverage beyond standard vulnerability disclosure channels has been identified (Wordfence).