CVE-2025-27296
Published: 24 February 2025
Summary
CVE-2025-27296 is a high-severity Missing Authorization (CWE-862) vulnerability. Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 26.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-27296 is a missing authorization vulnerability (CWE-862) in the WordPress plugin Auto Ad Inserter – Increase Google Adsense and Ad Manager Revenue, with the slug revenueflex-easy-ads. The flaw allows exploiting incorrectly configured access control security levels and affects all versions from n/a through 1.5. Published on 2025-02-24, it carries a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
Exploitation requires high privileges (PR:H), such as administrator-level access on a vulnerable WordPress site. An attacker with such privileges can trigger the vulnerability over the network (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N). Successful exploitation results in high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H), enabling unauthorized actions like settings changes within the plugin.
The Patchstack advisory documents this as a settings change vulnerability specifically in plugin version 1.5. Mitigation details are available in the referenced advisory, which covers patching and remediation for the affected WordPress plugin.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-4332
Vulnerability details
Missing Authorization vulnerability in revenueflex Auto Ad Inserter – Increase Google Adsense and Ad Manager Revenue revenueflex-easy-ads allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Auto Ad Inserter – Increase Google Adsense and Ad Manager Revenue: from n/a…
more
through <= 1.5.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes a missing authorization vulnerability in a public-facing WordPress plugin allowing network-based exploitation with high privileges to perform unauthorized settings changes, directly enabling exploitation of public-facing applications.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mandates enforcement of access control policies to prevent unauthorized settings changes exploiting missing authorization in the WordPress plugin.
Requires timely identification, reporting, and patching of the specific flaw in the Auto Ad Inserter plugin to eliminate the vulnerability.
Enforces least privilege to restrict high-privilege (PR:H) administrator actions, limiting the scope of exploitable functions within the plugin.