CVE-2025-23512
Published: 22 January 2025
Summary
CVE-2025-23512 is a high-severity Missing Authorization (CWE-862) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 47.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires the system to enforce approved authorizations for access to resources, directly addressing the missing authorization that enables unauthenticated arbitrary content deletion.
Mandates timely remediation of identified flaws like this plugin vulnerability, preventing exploitation through patching to versions beyond 1.6.0.
Ensures configuration settings for access controls are established, documented, and verified to the most restrictive mode, mitigating exploitation of incorrectly configured security levels in the plugin.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The missing authorization vulnerability in a public-facing WordPress plugin enables unauthenticated remote exploitation of the application (T1190) and directly facilitates arbitrary content deletion leading to high availability impact (T1485).
NVD Description
Missing Authorization vulnerability in 118group Team 118GROUP Agent team-118group-agent allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Team 118GROUP Agent: from n/a through <= 1.6.0.
Deeper analysisAI
CVE-2025-23512 is a missing authorization vulnerability (CWE-862) in the Team 118GROUP Agent WordPress plugin (team-118group-agent). It allows exploitation of incorrectly configured access control security levels, enabling arbitrary content deletion. The issue affects all versions of the plugin from n/a through 1.6.0 and was published on 2025-01-22.
Unauthenticated remote attackers with network access can exploit this vulnerability with low attack complexity and no user interaction. Exploitation leads to high availability impact (A:H) with no confidentiality or integrity effects, as reflected in its CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Attackers can delete arbitrary content on affected WordPress sites.
The Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/team-118group-agent/vulnerability/wordpress-team-118group-agent-plugin-1-6-0-arbitrary-content-deletion-vulnerability?_s_id=cve) documents this arbitrary content deletion vulnerability in plugin version 1.6.0. Security practitioners should consult the advisory for recommended mitigations.
Details
- CWE(s)