CVE-2025-24744

The Bridge Core plugin for WordPress versions up to and including 3.3 suffer from a missing authorization vulnerability. This broken access control issue means that certain functions do not properly check for user permissions or nonce tokens, potentially allowing unauthenticated users to perform actions intended for higher-privileged roles.

Exploitation does not require authentication, making the attack surface broad. The vulnerability is considered low complexity, and while Patchstack notes it is unlikely to be widely exploited, similar issues have been used in mass campaigns against thousands of sites [1]. Attackers could trigger privileged actions without proper authorization.

Successful exploitation could lead to unauthorized modification of site settings, content injection, or other administrative actions, depending on the affected functions. This can compromise the integrity and security of the WordPress installation.

The issue has been addressed in version 3.3.1. Users are strongly advised to update immediately. Patchstack users can enable auto-updates for vulnerable plugins to mitigate the risk [1].