CVE-2025-31798

Vulnerability

The Publitio WordPress plugin (publitio) versions up to and including 2.1.8 are affected by a missing authorization vulnerability. The issue resides in the plugin's access control security levels, allowing exploitation of incorrectly configured access controls. The plugin integrates with WordPress to provide media management features such as uploading, embedding, and managing media files from the Publitio cloud platform. No specific endpoint or function is named in the available references, but the vulnerability relates to improper authorization checks that can be bypassed. [1]

Exploitation

An attacker requires no authentication to exploit this vulnerability, as the missing authorization can be triggered by unauthenticated users. The attacker does not need a specific network position beyond regular web access to the WordPress site. The exact sequence of steps is not disclosed in the references, but the vulnerability class allows an attacker to access or modify protected resources by directly requesting certain endpoints or manipulating parameters that the plugin fails to properly authorize. [1]

Impact

Successful exploitation allows an attacker to access or modify resources that should be protected, leading to unauthorized actions within the WordPress instance. The exact impact depends on the unprotected functionality, but it can include information disclosure, data tampering, or privilege escalation depending on the missing authorization. The vulnerability is rated as Medium severity with a CVSS v3 score of 4.3, indicating a moderate impact on confidentiality and integrity. [1]

Mitigation

The plugin vendor released version 2.2.6 as an update that addresses this vulnerability. Users should update to Publitio 2.2.6 or later immediately. The plugin was last updated on April 23, 2026, and is tested up to WordPress 6.9.4. If updating is not immediately possible, users should review any custom access control configurations and ensure the plugin is not exposed to untrusted users. No workarounds beyond updating are provided in the available references. [1]