CVE-2026-25026: 
WordPress vulnerability analysis and mitigation

CVE-2026-25026 is a Missing Authorization (Broken Access Control) vulnerability in the RadiusTheme Team WordPress plugin (tlp-team) that allows unauthenticated attackers to exploit incorrectly configured access control security levels. It affects all versions of the plugin up to and including 5.0.11, with version 5.0.12 containing the fix. The vulnerability was reported on January 4, 2026, by researcher Doan Dinh Van and published by Patchstack on March 23, 2026. It carries a CVSS v3.1 base score of 7.5 (High) (Patchstack).

The root cause is classified as CWE-862 (Missing Authorization), meaning one or more plugin functions lack proper authorization, authentication, or nonce token checks before executing privileged actions. This allows unauthenticated network-based attackers to invoke functionality that should be restricted to higher-privileged users. No user interaction is required, and the attack complexity is low, making it straightforward to exploit remotely (Patchstack).

Successful exploitation primarily results in a high confidentiality impact — unauthenticated users can access restricted functionality or data that should require elevated privileges. Integrity and availability are not directly impacted according to the CVSS scoring. In a WordPress context, broken access control vulnerabilities of this type can expose sensitive site data or allow unauthorized administrative actions depending on the specific unprotected function (Patchstack).

No public proof-of-concept exploit code has been identified for this vulnerability. The EPSS score is approximately 0.017% (0.000170), indicating a low probability of exploitation in the near term. There is no evidence of active in-the-wild exploitation or CISA KEV catalog listing at this time. Patchstack notes that vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress sites at scale, regardless of site popularity (Patchstack).

The vendor has released version 5.0.12 of the Team plugin (tlp-team) by RadiusTheme, which resolves this vulnerability. All users running version 5.0.11 or earlier should update immediately. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard. If an immediate update is not possible, site owners should consult their hosting provider or web developer for assistance (Patchstack).

The vulnerability was covered in Wordfence's weekly WordPress vulnerability report for the period of March 23–29, 2026, as part of routine security intelligence reporting. No significant independent researcher commentary or broader media coverage has been identified beyond standard vulnerability database listings (Wordfence Blog).