CVE-2025-8446: 
WordPress vulnerability analysis and mitigation

CVE-2025-8446 is a missing authorization vulnerability in the Blaze Demo Importer plugin for WordPress that allows authenticated attackers with Subscriber-level access or above to install and activate a limited set of specific plugins without proper authorization. It affects all versions of the plugin up to and including 1.0.12. The vulnerability was published on September 16, 2025, and carries a CVSS v3.1 base score of 4.3 (Medium) (Wordfence, Red Hat CVE).

The root cause is a missing capability check (CWE-862) on the blaze_demo_importer_install_plugin function, which fails to verify whether the requesting user has sufficient privileges to install plugins. An authenticated attacker with as little as Subscriber-level access can send a crafted network request to invoke this function and trigger plugin installation. Exploitation requires two preconditions: the News Kit Elementor Addons plugin and a BlazeThemes theme must both be installed and activated on the target WordPress site. The vulnerable code path is visible in the plugin source at line 91 of blaze-demo-importer.php, and a patch was applied in changeset 3361179 (Wordfence, WordPress Trac).

Successful exploitation allows a low-privileged authenticated user to install and activate a limited number of specific plugins on the affected WordPress site, resulting in a low integrity impact with no confidentiality or availability impact. While the scope of installable plugins appears constrained, unauthorized plugin activation could introduce additional attack surface or functionality that a threat actor could leverage for further compromise. The vulnerability does not directly enable remote code execution or data exfiltration on its own (Wordfence).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for CVE-2025-8446. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.027%, indicating a very low probability of exploitation in the near term (Feedly). Exploitation is further constrained by the requirement that specific plugins and a BlazeThemes theme be pre-installed and active on the target site.

1. Reconnaissance: Identify WordPress sites running the Blaze Demo Importer plugin (versions ≤ 1.0.12) with the News Kit Elementor Addons plugin and a BlazeThemes theme installed and activated.
2. Obtain low-privilege access: Register or obtain credentials for a Subscriber-level (or higher) account on the target WordPress site.
3. Craft the request: Send an authenticated HTTP POST request invoking the blaze_demo_importer_install_plugin AJAX action, specifying the desired plugin slug as a parameter — no administrator nonce or capability is enforced.
4. Trigger unauthorized install: The function executes without a capability check, causing WordPress to download and activate the specified plugin from the allowed list.
5. Leverage installed plugin: Use any functionality introduced by the newly activated plugin to expand access or conduct further actions on the site (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing authenticated POST requests to wp-admin/admin-ajax.php with action=blaze_demo_importer_install_plugin from low-privilege user accounts.
• File System: Unexpected new plugin directories appearing under wp-content/plugins/ that were not installed by an administrator.
• Logs: WordPress activity logs (if an audit plugin is installed) recording plugin installation events attributed to Subscriber-level users.

Update the Blaze Demo Importer plugin to version 1.0.13 or later, which includes the fix applied in changeset 3361179 that adds proper capability checks to the blaze_demo_importer_install_plugin function. If an immediate update is not possible, restrict Subscriber-level user registration on the WordPress site or temporarily deactivate the Blaze Demo Importer plugin. Site administrators should also audit recently installed plugins for any unauthorized additions (WordPress Trac, Wordfence).

Wordfence disclosed the vulnerability as part of its weekly WordPress vulnerability report for the period of September 15–21, 2025, noting it as a medium-severity issue with limited exploitation potential due to its preconditions (Wordfence Blog). No significant broader media coverage or notable researcher commentary beyond the Wordfence disclosure has been identified.