CVE-2025-69346: 
WordPress vulnerability analysis and mitigation

CVE-2025-69346 is a Missing Authorization (Broken Access Control) vulnerability in the WPCenter AffiliateX WordPress plugin that allows authenticated attackers with low privileges to exploit incorrectly configured access control security levels. It affects AffiliateX versions up to and including 1.3.9.3, with version 1.4.0 being the patched release. The vulnerability was reported on December 7, 2025, and published by Patchstack on January 6, 2026. It carries a CVSS v3.1 base score of 4.3 (Medium), assigned by Patchstack (Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the plugin fails to perform adequate authorization checks before executing certain privileged actions. An authenticated user with Subscriber-level access can invoke functionality that should be restricted to higher-privileged roles, exploiting incorrectly configured access control security levels. The attack vector is network-based, requires low privileges, no user interaction, and low attack complexity, making it straightforward to exploit for any authenticated WordPress user (Patchstack).

Successful exploitation allows a low-privileged authenticated attacker to perform unauthorized actions that should be restricted to higher-privileged users, resulting in a limited integrity impact (CVSS: I:L). There is no direct confidentiality or availability impact per the Patchstack CVSS assessment. The practical consequence is that subscriber-level users could manipulate plugin settings or data in ways not intended by site administrators, though the overall severity is rated low by Patchstack (Patchstack).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.025% (0.000250), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress sites at scale, regardless of site popularity (Patchstack).

The vendor has released AffiliateX version 1.4.0, which resolves this vulnerability. Site administrators should update the AffiliateX plugin to version 1.4.0 or later immediately. If an immediate update is not possible, restricting user registration or limiting subscriber-level access on the WordPress site can reduce exposure. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard (Patchstack).