CVE-2025-69347
Published: 25 March 2026
Summary
CVE-2025-69347 is a high-severity Authorization Bypass Through User-Controlled Key (CWE-639) vulnerability. Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 28.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-69347 is an Authorization Bypass Through User-Controlled Key vulnerability in the WPSubscription WordPress plugin by Convers Lab. The flaw enables exploiting incorrectly configured access control security levels and affects all versions from n/a through 1.8.10. It is associated with CWE-639 and carries a CVSS v3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L), indicating high severity due to network accessibility and no required privileges or user interaction.
Unauthenticated attackers can exploit this vulnerability remotely with low complexity. By leveraging the user-controlled key, they can bypass authorization checks, achieving high-impact confidentiality loss such as unauthorized access to sensitive data, alongside low-impact integrity and availability effects.
The Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/subscription/vulnerability/wordpress-wpsubscription-plugin-1-8-10-insecure-direct-object-references-idor-vulnerability?_s_id=cve) characterizes this as an Insecure Direct Object References (IDOR) vulnerability in WPSubscription version 1.8.10. Security practitioners should consult the advisory for detailed mitigation guidance.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-208999
Vulnerability details
Authorization Bypass Through User-Controlled Key vulnerability in Convers Lab WPSubscription subscription allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPSubscription: from n/a through <= 1.8.10.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct remote exploitation of public-facing WordPress plugin via auth bypass/IDOR (CWE-639) with no credentials or interaction required.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the CVE by requiring identification, reporting, and timely remediation of the authorization bypass flaw in WPSubscription plugin versions through 1.8.10.
Enforces approved authorizations to block user-controlled key exploitation and IDOR-based bypass of access control security levels.
Limits privileges to the minimum necessary, reducing the impact of unauthorized access achieved via the user-controlled key vulnerability.