CVE-2025-2815

High

Published: 28 March 2025

Published

28 March 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0046 64.3th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-2815 is a high-severity Missing Authorization (CWE-862) vulnerability in Wordpress (inferred from references). Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 35.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Privilege Escalation (T1068). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

AC-3 Access Enforcement good match

prevent

Enforces approved authorizations for access to system resources, directly countering the missing capability check that allows unauthorized modification of WordPress site options.

AC-6 Least Privilege good match

prevent

Implements least privilege to restrict subscriber-level users from performing administrative actions like updating default registration roles for privilege escalation.

SI-2 Flaw Remediation good match

prevent

Requires timely remediation of flaws such as the missing authorization in the Administrator Z plugin, preventing exploitation through patching to versions after 2025.03.24.

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

attack.mitre.org →

Why these techniques?

Missing authorization check in WordPress plugin function allows authenticated low-privilege users to modify site options, directly enabling privilege escalation to administrator role.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

The Administrator Z plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the adminz_import_backup() function in all versions up to, and including, 2025.03.24. This makes it…

possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site. CVE-2025-26959 is a duplicate of this issue.

Deeper analysisAI

CVE-2025-2815, published on 2025-03-28, is a vulnerability in the Administrator Z plugin for WordPress affecting all versions up to and including 2025.03.24. It stems from a missing capability check in the adminz_import_backup() function, enabling unauthorized modification of data that results in privilege escalation. The issue carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-862 (Missing Authorization). CVE-2025-26959 is a duplicate of this vulnerability.

Authenticated attackers with Subscriber-level access or higher can exploit this flaw over the network with low complexity and no user interaction required. By calling the vulnerable function, they can update arbitrary WordPress site options, such as setting the default role for new user registrations to administrator and enabling registration. This allows attackers to self-register as administrators, achieving full site compromise including high confidentiality, integrity, and availability impacts.

Advisories from Wordfence and the WordPress plugin trac provide details on the issue, with a patch committed in the Administrator Z plugin repository at changeset 3262319. Security practitioners should update the plugin to a version after 2025.03.24 to mitigate the vulnerability.