CVE-2025-59133

Vulnerability

Projectopia (WordPress plugin) versions up to and including 5.1.25.2 contain an Insecure Direct Object References (IDOR) vulnerability in custom roles. The plugin fails to properly verify access rights when referencing internal objects, allowing users with a custom role to bypass authorization checks [1].

Exploitation

An authenticated user (with a custom role) can exploit the IDOR by sending crafted HTTP requests directly to the server, referencing objects (e.g., files, database entries) without proper permission validation [1]. No special network position is required beyond being a logged-in user with a custom role assignment.

Impact

Successful exploitation allows the attacker to bypass authorization, read sensitive data, access files/folders, or interact with the database beyond their intended privilege level [1]. The severity is high, with a CVSS v3 score of 7.5.

Mitigation

The vendor has released a fix; update Projectopia to version 5.1.26 or later. If immediate update is not possible, consult hosting provider or web developer for assistance. This vulnerability has been used in mass-exploit campaigns, so prompt patching is strongly advised [1].