CVE-2025-54711: 
WordPress vulnerability analysis and mitigation

The Info Cards – Add Text and Media in Card Layouts plugin for WordPress contains a Missing Authorization vulnerability (CVE-2025-54711) discovered in versions up to and including 1.0.11. The vulnerability was published on August 26, 2025, and was identified by researcher Denver Jackson (Rapid7, Patchstack).

The vulnerability is classified as a Missing Authorization/Broken Access Control issue with a CVSS score of 7.1, indicating moderate severity. The technical nature of the vulnerability stems from a missing capability check on a function, which allows authenticated users with Subscriber-level privileges or higher to perform unauthorized actions (Rapid7, Patchstack).

The vulnerability enables authenticated attackers with Subscriber-level access and above to perform unauthorized actions within the WordPress installation. This represents a significant security risk as it bypasses intended access control mechanisms (Rapid7).

The vulnerability has been patched in version 2.0.0 of the Info Cards plugin. Users are advised to update to version 2.0.0 or later immediately to resolve the vulnerability. Additionally, Patchstack has issued a mitigation rule to block potential attacks until users can update to the fixed version (Patchstack).