CVE-2026-25456
Published: 25 March 2026
Summary
CVE-2026-25456 is a high-severity Missing Authorization (CWE-862) vulnerability. Its CVSS base score is 7.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 16.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-24 (Access Control Decisions) and AC-3 (Access Enforcement).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires enforcement of approved authorizations for logical access to system resources, directly addressing the missing authorization checks in the WordPress plugin.
Mandates verifying access authorizations prior to allowing access to systems or resources, countering the plugin's failure to check security levels.
Applies least privilege to limit the scope and impact of unauthorized access enabled by the broken access control vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Missing authorization (CWE-862) in public-facing WordPress plugin allows unauthenticated remote exploitation with no user interaction, directly mapping to T1190 Exploit Public-Facing Application.
NVD Description
Missing Authorization vulnerability in Aarsiv Groups Automated FedEx live/manual rates with shipping labels a2z-fedex-shipping allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Automated FedEx live/manual rates with shipping labels: from n/a through <= 5.1.9.
Deeper analysisAI
CVE-2026-25456 is a missing authorization vulnerability, classified under CWE-862, in the WordPress plugin "Automated FedEx live/manual rates with shipping labels" (a2z-fedex-shipping) from Aarsiv Groups. The flaw enables exploitation of incorrectly configured access control security levels and affects all versions from n/a through 5.1.9. It carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).
Unauthenticated attackers can exploit this vulnerability remotely over the network with low attack complexity and no user interaction required. Successful exploitation grants limited impacts, including low-level access to confidentiality, integrity, and availability of affected systems.
Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/a2z-fedex-shipping/vulnerability/wordpress-automated-fedex-live-manual-rates-with-shipping-labels-plugin-5-1-8-broken-access-control-vulnerability?_s_id=cve.
Details
- CWE(s)