CVE-2025-23477
Published: 21 January 2025
Summary
CVE-2025-23477 is a high-severity Missing Authorization (CWE-862) vulnerability. Its CVSS base score is 8.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 26.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement).
Deeper analysis
CVE-2025-23477 is a missing authorization vulnerability in the Realty Workstation WordPress plugin (realty-workstation), affecting all versions up to and including 1.0.45. The flaw allows attackers to access functionality not properly constrained by access control lists (ACLs), as classified under CWE-862. It has a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L), indicating high severity due to network accessibility, low attack complexity, and no prerequisite privileges or user interaction.
Unauthenticated remote attackers can exploit this vulnerability over the network to gain unauthorized access to restricted functionality. Successful exploitation enables high integrity impacts, such as modifying data or configurations, alongside low availability effects, without compromising confidentiality.
The Patchstack advisory documents this broken access control issue in Realty Workstation plugin version 1.0.45 and provides further details on the vulnerability. Security practitioners should consult the advisory at https://patchstack.com/database/Wordpress/Plugin/realty-workstation/vulnerability/wordpress-realty-workstation-plugin-1-0-45-broken-access-control-vulnerability?_s_id=cve for mitigation guidance, such as applying available patches or updates.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-3203
Vulnerability details
Missing Authorization vulnerability in realtyworkstation Realty Workstation realty-workstation allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Realty Workstation: from n/a through <= 1.0.45.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes a missing authorization (broken access control) vulnerability in a public-facing WordPress plugin that allows unauthenticated remote attackers to access restricted functionality and modify data/configurations over the network, directly enabling exploitation of public-facing applications as per T1190.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Mandates enforcement of approved authorizations for access to system resources, directly addressing the missing ACL constraints exploited in this unauthenticated access vulnerability.
Prohibits unauthorized actions without identification or authentication, preventing unauthenticated attackers from accessing restricted functionality as seen in this CVE.
Employs least privilege to restrict access to only necessary functions, limiting the impact of broken authorization in the Realty Workstation plugin.