CVE-2025-69336: 
WordPress vulnerability analysis and mitigation

CVE-2025-69336 is a Missing Authorization (Broken Access Control) vulnerability in the bdthemes Ultimate Store Kit Elementor Addons WordPress plugin. It allows authenticated low-privileged users (e.g., Subscribers) to access restricted application data by exploiting incorrectly configured access control security levels. The vulnerability affects all plugin versions up to and including 2.9.4, with version 2.9.5 containing the fix. It was reported on November 30, 2025, and published on January 6, 2026, with a CVSS v3.1 base score of 4.3 (Medium) (Patchstack, NVD).

The root cause is CWE-862 (Missing Authorization) — the plugin fails to perform adequate authorization checks on one or more functions, allowing users with minimal privileges (Subscriber-level) to invoke actions that should be restricted to higher-privileged roles. The attack vector is network-based, requires low privileges, no user interaction, and low attack complexity, making it straightforward to exploit once an attacker has any authenticated session on the WordPress site. The vulnerability is classified under OWASP Top 10 A1: Broken Access Control (Patchstack).

Successful exploitation results in unauthorized read access to sensitive information within the WordPress application, with no impact on integrity or availability. An authenticated attacker with only Subscriber-level access can retrieve data they are not authorized to view, potentially exposing store configuration, customer data, or other plugin-managed content. The scope is limited to the affected WordPress instance, with no direct path to remote code execution or privilege escalation based on currently available information (Patchstack, NVD).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.025% (0.000250), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress sites at scale, regardless of site popularity (Patchstack).

1. Reconnaissance: Identify WordPress sites running the Ultimate Store Kit Elementor Addons plugin version ≤ 2.9.4 using tools like WPScan or Shodan with WordPress fingerprinting.
2. Obtain low-privileged access: Register or obtain a Subscriber-level account on the target WordPress site (many WooCommerce-enabled sites allow open registration).
3. Identify unprotected endpoints: Enumerate plugin-specific AJAX actions or REST API endpoints registered by the plugin that lack proper capability checks.
4. Send unauthorized request: Issue an authenticated HTTP request (with a valid nonce or session cookie) to the identified endpoint, bypassing the missing authorization check.
5. Retrieve sensitive data: Parse the server response to extract restricted application data such as store settings, order information, or other plugin-managed content (Patchstack).

• Logs: WordPress access logs showing authenticated requests from Subscriber-level users to plugin-specific AJAX endpoints (/wp-admin/admin-ajax.php) or REST API routes associated with ultimate-store-kit, particularly for actions not typically invoked by low-privileged users.
• Logs: Repeated or automated requests to the same plugin endpoint from a single authenticated session in a short time window, suggesting enumeration or data harvesting.
• Network: Unusual outbound data volume from the WordPress server following authenticated low-privilege logins, potentially indicating data exfiltration.
• Application: New or unexpected Subscriber-level user accounts created shortly before suspicious plugin endpoint activity.

The vendor (bdthemes) has released version 2.9.5 of the Ultimate Store Kit Elementor Addons plugin, which resolves this vulnerability. Site administrators should update the plugin immediately via the WordPress dashboard or by downloading the patched version from the WordPress plugin repository. If an immediate update is not possible, consider restricting user registration on the site or using a Web Application Firewall (WAF) such as Patchstack to virtually patch the vulnerability until the update can be applied (Patchstack).