CVE-2025-28938

Vulnerability

Overview

The WP Performance Pack plugin for WordPress, versions up to and including 2.5.3, suffers from a missing authorization vulnerability. This flaw stems from incorrectly configured access control security levels, allowing functions that should require higher privileges to be executed without proper authentication or nonce checks [1].

Exploitation

An attacker can exploit this vulnerability without needing any prior authentication or elevated privileges. The missing authorization check means that any unauthenticated user can trigger actions that are normally restricted to administrators or other privileged roles. The reference notes that such vulnerabilities are commonly used in mass-exploit campaigns targeting thousands of websites [1].

Impact

Successful exploitation could allow an attacker to perform unauthorized actions within the WordPress installation, potentially leading to data modification, privilege escalation, or other malicious activities depending on the specific functions exposed. The CVSS score of 4.3 indicates a medium severity, but the ease of exploitation and potential for automated attacks increases the risk [1].

Mitigation

The vulnerability has been addressed in version 2.5.4 of the plugin. Users are strongly advised to update immediately. For those unable to update, consulting with a hosting provider or web developer is recommended. Patchstack users can enable auto-updates for vulnerable plugins to ensure timely patching [1].