CVE-2025-49388
Published: 28 August 2025
Summary
CVE-2025-49388 is a critical-severity Incorrect Privilege Assignment (CWE-266) vulnerability. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 34.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the CVE by requiring identification, reporting, and correction of the privilege escalation flaw through timely patching of the Miraculous Core Plugin.
Enforces least privilege to limit the impact of incorrect privilege assignments in the plugin, preventing effective escalation by unauthenticated attackers.
Requires enforcement of approved access authorizations, countering the plugin's improper privilege grants that enable unauthenticated escalation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct unauthenticated remote exploitation of public-facing WordPress plugin for privilege escalation via incorrect privilege assignment.
NVD Description
Incorrect Privilege Assignment vulnerability in kamleshyadav Miraculous Core Plugin miraculouscore allows Privilege Escalation.This issue affects Miraculous Core Plugin: from n/a through <= 2.0.7.
Deeper analysisAI
CVE-2025-49388 is an Incorrect Privilege Assignment vulnerability (CWE-266) in the Miraculous Core Plugin (miraculouscore) for WordPress, developed by kamleshyadav. This issue enables privilege escalation and affects all versions of the plugin from its initial release through 2.0.7.
The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical), characterized by a network attack vector (AV:N), low attack complexity (AC:L), no required privileges (PR:N), and no user interaction (UI:N), resulting in high impacts to confidentiality, integrity, and availability (C:H/I:H/A:H). Unauthenticated remote attackers can exploit it to escalate privileges on affected WordPress sites.
Patchstack's advisory at https://patchstack.com/database/Wordpress/Plugin/miraculouscore/vulnerability/wordpress-miraculous-core-plugin-plugin-2-0-7-privilege-escalation-vulnerability?_s_id=cve documents this plugin vulnerability, with mitigation achieved by updating to a version of the Miraculous Core Plugin newer than 2.0.7.
Details
- CWE(s)