CVE-2025-24648
Published: 04 February 2025
Summary
CVE-2025-24648 is a high-severity Incorrect Privilege Assignment (CWE-266) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 34.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-6 (Least Privilege) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly addresses the CVE by requiring identification, reporting, and timely correction of the privilege escalation flaw in the WordPress plugin.
Enforces least privilege principle to restrict low-privileged users from escalating via incorrect privilege assignment in the plugin.
Mandates enforcement of approved access authorizations, blocking unauthorized privilege escalations exploited through the plugin vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is an incorrect privilege assignment in a WordPress plugin that directly enables an authenticated low-privilege user to escalate to high-level access, mapping to Exploitation for Privilege Escalation.
NVD Description
Incorrect Privilege Assignment vulnerability in Bowo Admin and Site Enhancements (ASE) admin-site-enhancements allows Privilege Escalation.This issue affects Admin and Site Enhancements (ASE): from n/a through <= 7.6.2.1.
Deeper analysisAI
CVE-2025-24648 is an Incorrect Privilege Assignment vulnerability (CWE-266) in the Bowo Admin and Site Enhancements (ASE) WordPress plugin (admin-site-enhancements), enabling privilege escalation. Published on 2025-02-04, it affects all versions of the plugin from n/a through 7.6.2.1. The vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), rated as High severity.
The attack requires network access and low privileges (such as a low-level authenticated WordPress user), but demands high attack complexity with no user interaction needed. Exploitation allows an attacker to escalate privileges, potentially gaining unauthorized high-level access within the affected WordPress site and achieving high impacts on confidentiality, integrity, and availability.
Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/admin-site-enhancements/vulnerability/wordpress-admin-and-site-enhancements-ase-plugin-7-6-1-1-privilege-escalation-vulnerability?_s_id=cve.
Details
- CWE(s)