CVE-2026-25456: 
WordPress vulnerability analysis and mitigation

CVE-2026-25456 is a Missing Authorization vulnerability in the "Automated FedEx live/manual rates with shipping labels" WordPress plugin (slug: a2z-fedex-shipping) developed by Aarsiv Groups. The flaw allows unauthenticated remote attackers to exploit incorrectly configured access control security levels. All plugin versions up to and including 5.1.9 are affected (ENISA references ≤ 5.1.8 in some records). It was published on March 25, 2026, and carries a CVSS v3.1 base score of 7.3 (High), assigned by Patchstack (Feedly, Patchstack).

The vulnerability is classified under CWE-862 (Missing Authorization), meaning the plugin fails to verify whether a requesting user has the appropriate permissions before executing sensitive operations. The attack vector is network-based, requires no authentication, no user interaction, and low attack complexity, making it trivially exploitable by any remote actor. The root cause is improperly configured or absent capability checks on one or more plugin endpoints or AJAX actions, a common pattern in WordPress plugin development where functions are registered without nonce or role verification (Feedly).

Successful exploitation results in low-level impacts across confidentiality, integrity, and availability — an attacker could read sensitive shipping configuration data, modify plugin settings or shipping rates, and cause minor disruption to the shipping label generation functionality. Because no authentication is required, any internet-facing WordPress site running the affected plugin version is at risk. While the individual impact per metric is rated "Low," the combination and the lack of any authentication barrier make this a meaningful risk for e-commerce sites relying on the plugin for FedEx shipping operations (Feedly).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the available data. The EPSS score is approximately 0.017% (0.000170), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Feedly).

Users should update the a2z-fedex-shipping WordPress plugin to a version beyond 5.1.9 as soon as a patched release is made available by Aarsiv Groups. In the interim, site administrators should consider deactivating the plugin if FedEx shipping functionality is not critical, or restrict access to the WordPress site's AJAX and REST API endpoints via a web application firewall (WAF) rule. Monitoring plugin update channels and the WordPress plugin repository for a patched release is strongly recommended (Feedly, Patchstack).