CVE-2025-64375

Vulnerability

Overview The WP Social Ninja plugin for WordPress (version 3.20.1 and earlier) contains a missing authorization vulnerability. The plugin fails to properly enforce access control checks on certain functions, allowing unauthenticated or low-privileged users to perform actions that should require higher privileges [1].

Exploitation

An attacker can exploit this vulnerability remotely without needing any authentication. The missing authorization check means that any user, including unauthenticated visitors, can trigger privileged operations. This type of vulnerability is commonly targeted in mass-exploit campaigns due to its ease of exploitation [1].

Impact

Successful exploitation allows an attacker to execute actions reserved for higher-privileged users, such as modifying plugin settings or accessing sensitive data. The exact impact depends on the specific missing authorization, but it can lead to unauthorized data exposure or site compromise [1].

Mitigation

The vulnerability has been patched in version 3.20.2. Users are strongly advised to update immediately. The vulnerability is listed as Known Exploited Vulnerability (KEV), indicating active exploitation in the wild [1].