CVE-2026-25308: 
WordPress vulnerability analysis and mitigation

CVE-2026-25308 is a Missing Authorization (Broken Access Control) vulnerability in the WordPress Simple Membership plugin by wp.insider. It affects all versions up to and including 4.6.9, allowing authenticated users with low privileges (Subscriber level) to exploit incorrectly configured access control security levels. The vulnerability was reported by Andrea Bocchetti on December 20, 2025, and published on January 19, 2026. It carries a CVSS v3.1 base score of 4.3 (Medium) (Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the plugin fails to perform adequate authorization checks before executing certain privileged actions. An authenticated attacker with Subscriber-level access can invoke higher-privileged functionality due to missing or improperly configured nonce token or capability checks. The attack vector is network-based, requires low privileges, no user interaction, and has low attack complexity (Patchstack).

Successful exploitation allows a low-privileged authenticated user to perform actions that should be restricted to higher-privileged roles, resulting in a low integrity impact with no confidentiality or availability impact. The scope is limited to the affected WordPress installation, and there is no evidence of data exposure or lateral movement potential. While the severity is low, Patchstack notes that vulnerabilities of this class are commonly used in mass-exploit campaigns targeting large numbers of WordPress sites (Patchstack).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.017%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an authenticated account with at least Subscriber-level privileges on the target WordPress site (Patchstack).

The vendor has released version 4.7.0 of the Simple Membership plugin, which resolves this vulnerability. Site administrators should update the plugin to version 4.7.0 or later immediately. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard. If an immediate update is not possible, site owners should contact their hosting provider or web developer for assistance (Patchstack).

Patchstack, which coordinated the disclosure, classifies this as a low-priority vulnerability with unlikely exploitation impact. The vulnerability was credited to researcher Andrea Bocchetti, who reported it through Patchstack's responsible disclosure process. No significant broader media coverage or notable community discussion has been identified (Patchstack).