CVE-2025-23512
Published: 22 January 2025
Summary
CVE-2025-23512 is a high-severity Missing Authorization (CWE-862) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 46.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-23512 is a missing authorization vulnerability (CWE-862) in the Team 118GROUP Agent WordPress plugin (team-118group-agent). It allows exploitation of incorrectly configured access control security levels, enabling arbitrary content deletion. The issue affects all versions of the plugin from n/a through 1.6.0 and was published on 2025-01-22.
Unauthenticated remote attackers with network access can exploit this vulnerability with low attack complexity and no user interaction. Exploitation leads to high availability impact (A:H) with no confidentiality or integrity effects, as reflected in its CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Attackers can delete arbitrary content on affected WordPress sites.
The Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/team-118group-agent/vulnerability/wordpress-team-118group-agent-plugin-1-6-0-arbitrary-content-deletion-vulnerability?_s_id=cve) documents this arbitrary content deletion vulnerability in plugin version 1.6.0. Security practitioners should consult the advisory for recommended mitigations.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-3222
Vulnerability details
Missing Authorization vulnerability in 118group Team 118GROUP Agent team-118group-agent allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Team 118GROUP Agent: from n/a through <= 1.6.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The missing authorization vulnerability in a public-facing WordPress plugin enables unauthenticated remote exploitation of the application (T1190) and directly facilitates arbitrary content deletion leading to high availability impact (T1485).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires the system to enforce approved authorizations for access to resources, directly addressing the missing authorization that enables unauthenticated arbitrary content deletion.
Mandates timely remediation of identified flaws like this plugin vulnerability, preventing exploitation through patching to versions beyond 1.6.0.
Ensures configuration settings for access controls are established, documented, and verified to the most restrictive mode, mitigating exploitation of incorrectly configured security levels in the plugin.