CVE-2025-49338

Vulnerability

Overview CVE-2025-49338 is a missing authorization vulnerability in the Flowbox plugin for WordPress, affecting versions from n/a through 1.1.6. The issue stems from incorrectly configured access control security levels, allowing unauthenticated attackers to bypass intended restrictions [1].

Exploitation

This broken access control vulnerability can be exploited without authentication, as the plugin fails to properly verify user permissions or nonce tokens or nonce checks in certain functions. Attackers can target any WordPress site running the vulnerable plugin version, regardless of traffic size or popularity [1].

Impact

Successful exploitation enables an attacker to perform higher-privileged actions that should be restricted, such as modifying plugin settings or accessing protected data. This vulnerability is known to be used in mass-exploit campaigns against thousands of websites simultaneously [1].

Mitigation

Users should immediately update the Flowbox plugin to a patched version beyond 1.1.6. If updating is not possible, contact your hosting provider or web developer for assistance [1].