CVE-2025-62906

The Referral Link Tracker plugin for WordPress, versions up to and including 1.1.4, contains a missing authorization vulnerability. This flaw stems from incorrectly configured access control security levels, which fail to properly verify user permissions before allowing certain actions [1].

An attacker can exploit this vulnerability without needing elevated privileges, as the plugin does not enforce proper authorization checks. The attack surface is broadened by the fact that such vulnerabilities are often used in mass-exploit campaigns targeting thousands of websites, regardless of their size or popularity [1].

The impact of successful exploitation includes the ability to perform unauthorized actions within the plugin, potentially leading to data exposure or manipulation. The CVSS v3 score of 4.3 (Medium) reflects the limited but real risk of broken access control [1].

As an immediate mitigation, users should update the plugin to a patched version if available. If updating is not possible, contacting a hosting provider or web developer for assistance is recommended [1].