CVE-2025-58249: 
WordPress vulnerability analysis and mitigation

The vulnerability (CVE-2024-58249) affects Qubely WordPress plugin versions 1.8.14 and below, involving sensitive information exposure that can be exploited by authenticated users with Contributor or higher privileges. The vulnerability was discovered by Abu Hurayra and was publicly disclosed on September 22, 2025 (Patchstack).

The vulnerability has been assigned a CVSS v3.1 base score of 4.3 (Medium), with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. The issue is classified under OWASP Top 10 category A1: Broken Access Control and is specifically categorized as a Sensitive Data Exposure vulnerability (Patchstack).

The vulnerability could allow malicious actors with authenticated access (Contributor level or higher) to view sensitive information that is normally not accessible to regular users. This exposed information could potentially be leveraged to exploit other weaknesses in the system (Patchstack).

As of the latest reports, no official fix is available for this vulnerability. The issue was initially reported on August 5, 2025, and an early warning was sent to Patchstack customers on September 22, 2025 (Patchstack).