CVE-2025-69361: 
WordPress vulnerability analysis and mitigation

CVE-2025-69361 is a Missing Authorization (Broken Access Control) vulnerability in the PublishPress Post Expirator WordPress plugin. It affects all versions through and including 4.9.3, allowing authenticated users with low privileges (Contributor-level or above) to exploit incorrectly configured access control security levels. The vulnerability was reported on December 12, 2025, by researcher Bao - BlueRock, published by Patchstack on January 6, 2026, and patched in version 4.9.4. It carries a CVSS v3.1 base score of 4.3 (Medium) (Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization), corresponding to OWASP Top 10 category A1: Broken Access Control. The root cause is a missing authorization, authentication, or nonce token check in one or more plugin functions, which allows an authenticated user with Contributor-level privileges to invoke actions that should be restricted to higher-privileged roles. Exploitation occurs over the network with low attack complexity and requires no user interaction beyond the attacker's own authenticated session (Patchstack).

Successful exploitation allows a low-privileged authenticated attacker to perform actions beyond their intended authorization level within the Post Expirator plugin, resulting in limited confidentiality exposure (CVSS C:L). The integrity and availability of the affected system are not directly impacted according to the CVSS assessment. The practical impact is constrained to the plugin's functionality scope, such as unauthorized manipulation of post expiration settings, and is assessed as low severity with no impactful threat by Patchstack (Patchstack).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that while vulnerabilities of this class can be used in mass-exploit campaigns targeting WordPress sites, this specific issue is assessed as unlikely to be exploited due to its low severity impact (Patchstack).

The vulnerability is patched in Post Expirator version 4.9.4, released by PublishPress. Site administrators should update the plugin to version 4.9.4 or later immediately. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard. If an immediate update is not possible, restricting Contributor-level user registration or access to the WordPress site can reduce exposure (Patchstack).

The vulnerability was discovered by researcher Bao - BlueRock and disclosed through Patchstack's Vulnerability Disclosure Program. Patchstack published the advisory on January 11, 2026, and it was covered in Sucuri's January 2026 vulnerability patch roundup. No significant broader media coverage or notable researcher commentary beyond the initial disclosure has been identified.