CVE-2026-25000: 
WordPress vulnerability analysis and mitigation

CVE-2026-25000 is a Missing Authorization vulnerability in the Kraft Plugins "Wheel of Life" WordPress plugin that allows unauthenticated attackers to exploit incorrectly configured access control security levels. The vulnerability affects all versions of the plugin up to and including 1.2.0. It was published on February 19, 2026, and carries a CVSS v3.1 base score of 5.3 (Medium) (Feedly).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether a requesting user has the necessary permissions before performing sensitive operations. This allows network-based attackers with no authentication or privileges required to interact with restricted functionality. The attack complexity is low and requires no user interaction, making it straightforward to exploit remotely (Feedly).

Successful exploitation results in a low integrity impact, allowing unauthorized modification of data or plugin state without any confidentiality or availability impact. Because no authentication is required, any remote attacker can trigger the misconfigured access control paths. The scope is unchanged, meaning the impact is confined to the vulnerable plugin's context within the WordPress installation (Feedly).

The vulnerability has a low EPSS score of approximately 0.017%, suggesting limited likelihood of widespread automated exploitation at this time. No evidence of in-the-wild exploitation, public proof-of-concept code, or threat actor attribution has been reported. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly).

Users should update the Wheel of Life WordPress plugin to a version beyond 1.2.0 as soon as a patched release is made available by Kraft Plugins. In the interim, site administrators should consider deactivating the plugin if it is not critical to operations, or restricting access to the WordPress installation via network-level controls. Monitoring WordPress admin logs for unexpected or unauthorized plugin interactions is also advisable (Feedly).