CVE-2025-69347
Published: 25 March 2026
Summary
CVE-2025-69347 is a high-severity Authorization Bypass Through User-Controlled Key (CWE-639) vulnerability. Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 18.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the CVE by requiring identification, reporting, and timely remediation of the authorization bypass flaw in WPSubscription plugin versions through 1.8.10.
Enforces approved authorizations to block user-controlled key exploitation and IDOR-based bypass of access control security levels.
Limits privileges to the minimum necessary, reducing the impact of unauthorized access achieved via the user-controlled key vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct remote exploitation of public-facing WordPress plugin via auth bypass/IDOR (CWE-639) with no credentials or interaction required.
NVD Description
Authorization Bypass Through User-Controlled Key vulnerability in Convers Lab WPSubscription subscription allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPSubscription: from n/a through <= 1.8.10.
Deeper analysisAI
CVE-2025-69347 is an Authorization Bypass Through User-Controlled Key vulnerability in the WPSubscription WordPress plugin by Convers Lab. The flaw enables exploiting incorrectly configured access control security levels and affects all versions from n/a through 1.8.10. It is associated with CWE-639 and carries a CVSS v3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L), indicating high severity due to network accessibility and no required privileges or user interaction.
Unauthenticated attackers can exploit this vulnerability remotely with low complexity. By leveraging the user-controlled key, they can bypass authorization checks, achieving high-impact confidentiality loss such as unauthorized access to sensitive data, alongside low-impact integrity and availability effects.
The Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/subscription/vulnerability/wordpress-wpsubscription-plugin-1-8-10-insecure-direct-object-references-idor-vulnerability?_s_id=cve) characterizes this as an Insecure Direct Object References (IDOR) vulnerability in WPSubscription version 1.8.10. Security practitioners should consult the advisory for detailed mitigation guidance.
Details
- CWE(s)