CVE-2026-25011: 
WordPress vulnerability analysis and mitigation

CVE-2026-25011 is a Missing Authorization (Broken Access Control) vulnerability in the WP Custom Admin Interface WordPress plugin by Northern Beaches Websites. It affects all versions up to and including 7.41, and was reported on December 26, 2025 by researcher Legion Hunter, with public disclosure on January 25, 2026. The vulnerability carries a CVSS v3.1 base score of 4.3 (Medium) (Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether a requesting user has the necessary permissions before executing certain privileged actions. A low-privileged authenticated user (e.g., a Subscriber-level account) can exploit this by sending crafted requests to plugin functions that lack proper authorization or nonce token checks, thereby performing actions intended for higher-privileged roles. No complex attack conditions are required — the attack vector is network-based, requires low privileges, no user interaction, and low attack complexity (Patchstack).

Successful exploitation allows a low-privileged authenticated attacker to perform unauthorized actions within the WordPress admin interface customization functionality, resulting in a limited integrity impact (CVSS integrity impact: Low). Confidentiality and availability are not directly affected. While the individual impact is constrained, such broken access control flaws in widely deployed WordPress plugins are frequently leveraged in mass-exploit campaigns targeting thousands of sites simultaneously (Patchstack).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack classifies this as low priority with unlikely exploitation, though broken access control vulnerabilities in WordPress plugins are commonly targeted in automated mass-scanning campaigns (Patchstack).

1. Reconnaissance: Identify WordPress sites running the WP Custom Admin Interface plugin version 7.41 or earlier using tools like WPScan or Shodan.
2. Obtain low-privileged access: Register or obtain a Subscriber-level (or equivalent low-privilege) account on the target WordPress site.
3. Identify unprotected endpoints: Enumerate plugin AJAX actions or admin-post endpoints associated with the WP Custom Admin Interface plugin that lack capability checks or nonce validation.
4. Send unauthorized request: Craft and submit an HTTP POST request to the vulnerable endpoint (e.g., wp-admin/admin-ajax.php with the relevant action parameter) while authenticated as a low-privileged user, bypassing the intended access control.
5. Achieve unauthorized action: Successfully trigger a privileged plugin function — such as modifying admin interface settings — without the required administrator permissions (Patchstack).

• Logs: WordPress access logs showing POST requests to wp-admin/admin-ajax.php or wp-admin/admin-post.php from Subscriber-level user accounts targeting WP Custom Admin Interface plugin actions.
• Logs: Unexpected changes to WordPress admin interface customization settings in the database (wp_options table entries related to wp-custom-admin-interface) made by non-administrator users.
• Network: Automated or high-frequency requests to plugin AJAX endpoints from a single IP or user agent, indicative of mass-scanning activity.

The vendor has released version 7.42 of the WP Custom Admin Interface plugin, which patches this vulnerability. Site administrators should update to version 7.42 or later immediately via the WordPress plugin dashboard. If an immediate update is not possible, consider temporarily deactivating the plugin or restricting site registration to prevent low-privileged account creation. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard (Patchstack).