CVE-2026-25410: 
WordPress vulnerability analysis and mitigation

CVE-2026-25410 is a Missing Authorization vulnerability in the WP-CORS WordPress plugin developed by tstephenson. The flaw allows authenticated attackers with low-level privileges to exploit incorrectly configured access control security levels, potentially modifying plugin settings or data. It affects WP-CORS versions from the initial release through 0.2.2 (inclusive). The vulnerability was published on February 19, 2026, and carries a CVSS v3.1 base score of 4.3 (Medium) (Feedly).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether a requesting user has the necessary permissions before performing sensitive operations. The attack vector is network-based, requires low privileges (an authenticated WordPress user), and no user interaction, making it straightforward to exploit from any authenticated session. The vulnerability falls under the broader category of Broken Access Control, where plugin endpoints or AJAX actions lack capability checks, allowing lower-privileged users to perform actions reserved for administrators (Feedly).

Successful exploitation results in a low integrity impact — an authenticated attacker can modify CORS-related plugin settings or configurations that they should not have access to, potentially altering cross-origin resource sharing policies for the affected WordPress site. There is no confidentiality or availability impact reported. While the direct impact is limited, manipulating CORS settings could indirectly enable cross-origin attacks against site visitors or weaken the site's security posture (Feedly).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.017%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum a low-privileged authenticated account on the target WordPress installation (Feedly).

1. Reconnaissance: Identify WordPress sites running the WP-CORS plugin version 0.2.2 or earlier, using tools like WPScan or by checking the plugin's readme.txt file accessible at /wp-content/plugins/wp-cors/readme.txt.
2. Obtain low-privileged access: Register or obtain credentials for any low-privileged WordPress account (e.g., Subscriber role) on the target site.
3. Identify unprotected endpoints: Enumerate plugin AJAX actions or admin endpoints that lack proper capability checks, typically by reviewing the plugin's source code or intercepting requests with a proxy tool like Burp Suite.
4. Send unauthorized request: Craft and send an authenticated HTTP request (with valid nonce/cookie) to the vulnerable endpoint to modify CORS plugin settings, bypassing the missing authorization check.
5. Achieve objective: Successfully alter CORS configuration (e.g., allow arbitrary origins), potentially enabling cross-origin requests from attacker-controlled domains against the site's API or authenticated endpoints.

• Logs: WordPress access logs showing POST requests to /wp-admin/admin-ajax.php or plugin-specific endpoints from low-privileged user accounts at unusual times.
• Logs: WordPress audit logs (if enabled via a plugin) recording unauthorized changes to WP-CORS plugin settings by non-administrator users.
• File System: Unexpected modifications to WP-CORS plugin option values in the WordPress database (wp_options table), particularly the CORS-related settings entries.
• Network: Unusual cross-origin requests to the WordPress site from previously unauthorized domains following a potential exploitation event.

Users should update the WP-CORS plugin to a version beyond 0.2.2 if a patched release is available from the plugin author (tstephenson). If no patch is available, site administrators should consider deactivating and removing the plugin until a fix is released. As a general workaround, restrict WordPress user registrations and limit the number of low-privileged accounts on the site to reduce the attack surface. Monitor the WordPress plugin repository for an updated release (Feedly, Patchstack).