CVE-2025-24692
Published: 14 February 2025
Summary
CVE-2025-24692 is a high-severity Missing Authorization (CWE-862) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 33.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
AC-3 enforces approved authorizations for access to system resources, directly mitigating the missing authorization vulnerability in the Bulk Menu Edit plugin.
AC-6 applies the principle of least privilege to restrict low-privileged authenticated users from performing unauthorized bulk menu edits.
SI-2 requires timely flaw remediation, directly addressing the specific broken access control flaw in Bulk Menu Edit plugin versions through n/a to <=1.3.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes a broken access control vulnerability in a publicly accessible WordPress plugin, directly enabling exploitation of a public-facing web application over the network by an authenticated low-privilege user.
NVD Description
Missing Authorization vulnerability in M.Code Bulk Menu Edit bulk-menu-edit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bulk Menu Edit: from n/a through <= 1.3.
Deeper analysisAI
CVE-2025-24692 is a missing authorization vulnerability (CWE-862) in the Bulk Menu Edit WordPress plugin (bulk-menu-edit) by M.Code. The issue stems from exploiting incorrectly configured access control security levels and affects all versions from n/a through 1.3 inclusive. Published on 2025-02-14, it carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H).
An attacker requires low privileges (PR:L), such as those of an authenticated WordPress user, to exploit the vulnerability over the network (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N). Successful exploitation enables low impact to integrity (I:L) and high impact to availability (A:H), with no confidentiality impact (C:N), in an unchanged scope (S:U).
Patchstack provides details on this broken access control vulnerability specific to Bulk Menu Edit plugin version 1.3. Refer to https://patchstack.com/database/Wordpress/Plugin/bulk-menu-edit/vulnerability/wordpress-bulk-menu-edit-plugin-1-3-broken-access-control-vulnerability?_s_id=cve for advisory information, including recommended mitigations and patches.
Details
- CWE(s)