CVE-2025-31887

Vulnerability

A missing authorization vulnerability exists in MyBookProgress by Stormhill Media, a WordPress plugin, affecting versions from n/a through 1.0.8 [1]. The flaw resides in the plugin's access control mechanisms, allowing exploitation of incorrectly configured security levels. This issue is classified as a Missing Authorization vulnerability [1].

Exploitation

To exploit this vulnerability, an attacker requires no special network position beyond standard WordPress user access. The lack of proper authorization checks means that an attacker with low privileges (such as a subscriber) can access restricted functionality or data without further authentication [1]. Specific steps are not detailed in the available references, but the nature of the bug suggests direct manipulation of requests or endpoints lacking capability checks.

Impact

Successful exploitation leads to information disclosure or unauthorized modification of data depending on the affected endpoints. The attacker gains the ability to bypass intended access controls, potentially viewing or altering book progress entries for other users, or other restricted actions [1]. The CIA impact is limited by the plugin's scope but could compromise user privacy and data integrity.

Mitigation

The plugin has been closed and removed from the WordPress.org plugin directory as of January 16, 2025, due to a security issue [1]. No patched version is available. Users who have the plugin installed should uninstall it immediately [1]. There is no known workaround, and the plugin is effectively end-of-life [1].