CVE-2025-62914

The Effect Maker plugin for WordPress, versions up to 1.2.1, contains a missing authorization vulnerability. The root cause is the lack of proper access control checks on certain functions, allowing exploitation of incorrectly configured access control security levels [1].

An attacker can exploit this vulnerability without authentication, as the plugin fails to verify user privileges before executing sensitive actions. No special network position is required; typical web requests can trigger the flaw [1].

Successful exploitation could allow an attacker to perform actions normally restricted to higher-privileged users, potentially leading to privilege escalation or unauthorized modifications. The vulnerability is expected to be exploited in mass campaigns targeting thousands of sites [1].

The vendor has likely released a patched version. Users should update the plugin to the latest version. If unable, consult a hosting provider. The vulnerability has a CVSS score of 6.5 (Medium) and is listed as potentially exploitable by mass campaigns [1].