CVE-2025-24653

The vulnerability is a missing authorization check in the Admin and Site Enhancements (ASE) Pro plugin for WordPress, affecting versions up to 7.6.1.1. The plugin fails to properly verify access control security levels, allowing an attacker to bypass intended restrictions [1].

Exploitation does not require authentication, as the missing authorization means any unauthenticated user can trigger functions that should be restricted to higher-privileged roles. The attack surface is the plugin's administrative and site enhancement features that lack proper nonce or capability checks [1].

An attacker can exploit this to perform actions reserved for administrators, such as modifying site settings or accessing sensitive data. While the vulnerability is rated low severity and considered unlikely to be exploited in typical scenarios, it could be chained with other issues in mass-exploit campaigns [1].

The issue is patched in version 7.6.3. Users are strongly advised to update immediately. Patchstack users can enable auto-updates for vulnerable plugins to ensure protection [1].