CVE-2025-30978

Vulnerability

The Slack Notifications by dorzki plugin (slug: dorzki-notifications-to-slack) for WordPress contains a Missing Authorization vulnerability [1]. Versions through 2.0.7 are affected. The issue arises from incorrectly configured access control security levels, allowing unauthorized exploitation.

Exploitation

An attacker with no special privileges can exploit the missing authorization check if the plugin is installed and active on a WordPress site. No authentication or user interaction is required beyond being able to send requests to the plugin's endpoints. The exact attack vector is not detailed in the available references, but the nature of the vulnerability indicates that direct network requests can trigger actions or access data meant to be restricted.

Impact

Successful exploitation could lead to unauthorized actions or information disclosure, depending on the specific endpoint exposed. The vulnerability is classified with a CVSS v3 score of 4.3 (Medium), indicating limited impact but potential for partial compromise. The plugin has been closed and removed from the WordPress.org plugin directory due to a security issue [1].

Mitigation

The plugin has been closed and removed from the official WordPress.org plugin directory as of May 1, 2025 [1]. No patched version is available through the official channel. Users should immediately uninstall the plugin from their WordPress sites [1]. There is no known workaround except complete removal. The plugin is not listed in the CISA KEV catalog at this time.