CVE-2025-49348

Vulnerability

Overview The Hype pico plugin for WordPress, up to version 1.0.5, contains a missing authorization vulnerability. The plugin fails to properly verify access control security levels, allowing unauthorized exploitation of protected functions or resources. This flaw is categorized as a broken access control issue [1].

Exploitation

Attackers can exploit this vulnerability without authentication, as the missing authorization check does not require a valid user session or nonce token. This makes it suitable for mass-exploit campaigns targeting thousands of websites, regardless of their size or popularity [1].

Impact

Successful exploitation allows an unprivileged attacker to execute actions that should be restricted to higher-privileged users, potentially leading to unauthorized data access, modification, or other malicious activities within the affected WordPress installation [1].

Mitigation

The vulnerability affects all versions of the Hype plugin up to and including 1.0.5. Users are strongly advised to update the plugin immediately to a patched version. If unable to do so, they should contact their hosting provider or web developer for assistance [1].