CVE-2026-25384: 
WordPress vulnerability analysis and mitigation

CVE-2026-25384 is a Missing Authorization vulnerability in the WP Lab WP-Lister Lite for eBay WordPress plugin that allows unauthenticated attackers to exploit incorrectly configured access control security levels. It affects all versions of the plugin from n/a through 3.8.5. The vulnerability was published on February 19, 2026, and carries a CVSS v3.1 base score of 5.3 (Medium) (Feedly).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify that a requesting user has the necessary permissions before performing sensitive operations. Because no authentication or privilege check is enforced on the affected functionality, network-accessible attackers with no credentials or user interaction can trigger restricted actions. No detailed technical write-up or public proof-of-concept code has been identified at this time (Feedly).

Successful exploitation results in a low-level confidentiality impact, allowing unauthenticated remote attackers to access information that should be restricted by access controls within the plugin. Integrity and availability are not directly affected according to the CVSS scoring. The scope is limited to the affected WordPress plugin environment, with no evidence of lateral movement potential beyond the plugin's data (Feedly).

The vulnerability requires no authentication, no user interaction, and has low attack complexity, making it trivially exploitable by any network-accessible attacker. The EPSS score is approximately 0.017%, indicating a currently low probability of active exploitation in the wild. No exploit kits, weaponized code, threat actor attribution, or CISA KEV catalog listing have been identified for this CVE (Feedly).

Users should update the WP-Lister Lite for eBay plugin to a version beyond 3.8.5 as soon as a patched release is made available by WP Lab. In the interim, site administrators should consider disabling the plugin if it is not critical to operations, or restrict access to the WordPress installation via network-level controls (e.g., firewall rules, IP allowlisting). Monitoring WordPress access logs for unexpected or unauthorized requests to plugin endpoints is also advisable (Feedly).