CVE-2025-54743: 
WordPress vulnerability analysis and mitigation

CVE-2025-54743 is a Missing Authorization vulnerability in the Download After Email WordPress plugin developed by mkscripts. It allows unauthenticated attackers to exploit incorrectly configured access control security levels (CWE-862). The vulnerability affects plugin versions 2.1.5 through 2.1.6, with version 2.1.7 released as the patched fix. It was reported on June 5, 2025, and publicly disclosed on September 25, 2025, by Patchstack researcher Marcin 'maskopatol' Nowak. The CVSS v3.1 base score is 5.3 (Medium) per NVD, while Patchstack rates it 5.8 (Patchstack).

The root cause is CWE-862 (Missing Authorization) — the plugin fails to properly enforce access control checks on certain functionality, allowing unauthenticated network requests to interact with restricted features. The attack vector is network-based, requires no privileges or user interaction, and has low attack complexity, making it trivially accessible to remote attackers. The vulnerability is classified under OWASP Top 10 A4: Insecure Design, indicating a design-level failure to restrict access to protected operations (Patchstack).

Exploitation of this vulnerability results in a limited availability impact (Low), with no confidentiality or integrity impact according to the CVSS scoring. An unauthenticated attacker could abuse the missing authorization controls to trigger unintended plugin functionality, potentially disrupting the download-gating mechanism that the plugin provides. The scope is unchanged, meaning impact is confined to the vulnerable plugin component itself rather than the broader WordPress installation (Patchstack).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-54743. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that while vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress plugins at scale, this specific issue is assessed as low priority and unlikely to be actively exploited (Patchstack).

The vendor has released version 2.1.7 of the Download After Email plugin, which resolves this vulnerability. Site administrators should update the plugin to version 2.1.7 or later immediately via the WordPress admin dashboard. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard. If an immediate update is not possible, site owners should consult their hosting provider or web developer for assistance (Patchstack).

The vulnerability was discovered and disclosed by Patchstack researcher Marcin 'maskopatol' Nowak, with Patchstack serving as the CVE assigner. No notable broader media coverage, vendor statements beyond the patch release, or significant community discussion has been identified for this low-severity issue (Patchstack).