CVE-2025-54045: 
WordPress vulnerability analysis and mitigation

CVE-2025-54045 is a Missing Authorization (Broken Access Control) vulnerability in the CreativeMindsSolutions CM On Demand Search And Replace WordPress plugin. It allows authenticated users with low privileges (Subscriber level) to exploit incorrectly configured access control security levels. The vulnerability affects all versions of the plugin through 1.5.5, with no official patch available as of the latest reporting. It was first published on December 16, 2025, and carries a CVSS v3.1 base score of 4.3 (Medium), assigned by Patchstack (Patchstack, NVD).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether a requesting user has the necessary permissions before executing certain privileged actions. This allows a low-privileged authenticated user (e.g., a Subscriber) to perform actions that should be restricted to higher-privileged roles. The attack vector is network-based, requires low privileges, no user interaction, and low attack complexity. The CVSS vector was updated by Patchstack in April 2026 to reflect an integrity impact rather than a confidentiality impact (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), suggesting the exploitable function may allow unauthorized modification of content or settings (Patchstack, NVD).

Successful exploitation allows a low-privileged authenticated attacker to perform unauthorized actions within the WordPress site, specifically impacting integrity (e.g., unauthorized search-and-replace operations on site content or database entries). The confidentiality and availability impacts are assessed as none. While the severity is rated Medium, mass-exploit campaigns targeting WordPress plugins of this type are common, and the impact could be significant on sites where subscriber-level accounts are broadly accessible (Patchstack).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for CVE-2025-54045. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress sites at scale, regardless of site popularity (Patchstack).

1. Reconnaissance: Identify WordPress sites running the CM On Demand Search And Replace plugin (versions ≤ 1.5.5) using tools like WPScan or by checking publicly exposed plugin directories (/wp-content/plugins/cm-on-demand-search-and-replace/).
2. Obtain low-privileged access: Register or obtain a Subscriber-level account on the target WordPress site, which is often open for public registration.
3. Identify unprotected endpoints: Enumerate plugin-specific AJAX actions or admin-ajax.php endpoints associated with the CM On Demand Search And Replace plugin that lack proper capability checks.
4. Send unauthorized request: Craft and send an authenticated HTTP request (with a valid nonce or session cookie) to the vulnerable endpoint, invoking a privileged function such as triggering a search-and-replace operation on site content.
5. Achieve unauthorized action: The server processes the request without verifying the user's role, allowing the attacker to modify site content or settings beyond their intended privilege level (Patchstack).

• Logs: WordPress access logs showing authenticated POST requests to wp-admin/admin-ajax.php with action parameters associated with the CM On Demand Search And Replace plugin from Subscriber-level user accounts.
• Logs: Unexpected content modification events in WordPress audit logs (if an audit plugin is installed) attributed to low-privileged users.
• File System: Unexpected changes to post content, options, or database entries that correlate with search-and-replace functionality being invoked outside of administrative sessions.
• Network: Repeated authenticated requests to plugin-specific endpoints from the same IP address, potentially indicating automated exploitation attempts.

As of the latest available information, no official patched version of the CM On Demand Search And Replace plugin has been released; the vulnerability affects all versions through 1.5.5 (Patchstack). Site administrators should consider deactivating and removing the plugin until a fix is available. As a workaround, disabling open user registration or restricting Subscriber-level account creation can reduce the attack surface. Patchstack's virtual patching feature can provide immediate mitigation for sites using their service.

The vulnerability was discovered and reported by a researcher named Mika and disclosed by Patchstack on December 16, 2025. Patchstack classifies it as low priority with unlikely exploitation impact, though they note that broken access control vulnerabilities in WordPress plugins are frequently targeted in mass-exploit campaigns (Patchstack). No significant broader media coverage or notable researcher commentary beyond the Patchstack advisory has been identified.