CVE-2025-69091: 
WordPress vulnerability analysis and mitigation

CVE-2025-69091 is a Missing Authorization vulnerability in the Kraft Plugins Demo Importer Plus WordPress plugin that allows authenticated attackers with low privileges to exploit incorrectly configured access control security levels. It affects all versions of the plugin from n/a through 2.0.8 (inclusive). The vulnerability was published on December 30, 2025, and assigned by Patchstack. It carries a CVSS v3.1 base score of 4.3 (Medium) (Feedly, EUVD).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether a requesting user has the necessary permissions before executing sensitive functionality. The attack vector is network-based, requires low privileges (authenticated user), low attack complexity, and no user interaction. An attacker with a basic WordPress account can send crafted requests to plugin endpoints that lack proper capability checks, thereby performing actions that should be restricted to higher-privileged roles such as administrators (Feedly).

Successful exploitation results in a limited integrity impact — an authenticated low-privileged attacker can perform unauthorized actions within the plugin's functionality, such as importing demo content or modifying plugin-controlled data, without administrator approval. There is no direct confidentiality or availability impact reported. The scope is unchanged, meaning exploitation is confined to the affected plugin's context and does not directly enable lateral movement or system-level compromise (Feedly).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for CVE-2025-69091. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. Exploitation requires at minimum a low-privileged authenticated WordPress account on the target site (Feedly).

1. Reconnaissance: Identify WordPress sites running the Demo Importer Plus plugin (version ≤ 2.0.8) using tools like WPScan or by inspecting plugin directories exposed via the target site.
2. Obtain low-privileged access: Register or obtain credentials for a low-privileged WordPress account (e.g., Subscriber or Contributor role) on the target site.
3. Identify unprotected endpoints: Enumerate the plugin's AJAX actions or REST API endpoints that lack proper current_user_can() capability checks — these are the access-controlled functions the plugin exposes.
4. Send unauthorized request: Craft and send an authenticated HTTP request (e.g., a WordPress AJAX POST to wp-admin/admin-ajax.php with the relevant action parameter) to trigger a restricted plugin function such as demo content import.
5. Achieve unauthorized action: The server processes the request without verifying the user's role, resulting in unauthorized modification of site content or plugin state (Feedly).

• Logs: WordPress access logs showing POST requests to wp-admin/admin-ajax.php with plugin-specific action parameters from low-privileged user accounts at unusual times.
• Logs: WordPress debug logs or audit logs recording demo import or plugin configuration actions performed by non-administrator users.
• File System: Unexpected changes to WordPress content (pages, posts, media) consistent with demo content being imported without administrator initiation.
• Network: Repeated authenticated requests from the same low-privileged user account targeting plugin AJAX endpoints in a short time window.

Users should update the Demo Importer Plus plugin to a version beyond 2.0.8 that includes proper authorization checks. Check the WordPress plugin repository or the Kraft Plugins vendor page for the latest patched release. If an update is not immediately available, site administrators should consider deactivating the plugin until a fix is confirmed, or restricting new user registrations to limit the pool of potential low-privileged attackers (Feedly, EUVD).