CVE-2025-31799

Vulnerability

The Publitio WordPress plugin (publitio) versions through 2.1.8 contain a missing authorization vulnerability. This flaw allows exploitation of incorrectly configured access control security levels, potentially enabling unauthorized actions within the plugin's functionality. The plugin integrates with the Publitio cloud media platform for media management and embedding [1].

Exploitation

An attacker with network access to the WordPress site can exploit this vulnerability by sending crafted requests to vulnerable endpoints that lack proper authorization checks. No authentication is required if the access control is misconfigured, allowing the attacker to bypass intended restrictions.

Impact

Successful exploitation could allow an attacker to perform unauthorized actions such as accessing, uploading, or modifying media files, or executing other administrative functions depending on the misconfigured permissions. This may lead to information disclosure or data manipulation.

Mitigation

The vulnerability is fixed in version 2.2.6 of the Publitio plugin [1]. Users should update to this version or later immediately. No workarounds are documented. The plugin is available from the WordPress plugin repository.