Cyber Posture

CVE-2026-25456

High

Published: 25 March 2026

Published
25 March 2026
Modified
28 April 2026
KEV Added
Patch
CVSS Score 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0005 16.0th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-25456 is a high-severity Missing Authorization (CWE-862) vulnerability. Its CVSS base score is 7.3 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 16.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-24 (Access Control Decisions) and AC-3 (Access Enforcement).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Requires enforcement of approved authorizations for logical access to system resources, directly addressing the missing authorization checks in the WordPress plugin.

prevent

Mandates verifying access authorizations prior to allowing access to systems or resources, countering the plugin's failure to check security levels.

prevent

Applies least privilege to limit the scope and impact of unauthorized access enabled by the broken access control vulnerability.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Missing authorization (CWE-862) in public-facing WordPress plugin allows unauthenticated remote exploitation with no user interaction, directly mapping to T1190 Exploit Public-Facing Application.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Missing Authorization vulnerability in Aarsiv Groups Automated FedEx live/manual rates with shipping labels a2z-fedex-shipping allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Automated FedEx live/manual rates with shipping labels: from n/a through <= 5.1.9.

Deeper analysisAI

CVE-2026-25456 is a missing authorization vulnerability, classified under CWE-862, in the WordPress plugin "Automated FedEx live/manual rates with shipping labels" (a2z-fedex-shipping) from Aarsiv Groups. The flaw enables exploitation of incorrectly configured access control security levels and affects all versions from n/a through 5.1.9. It carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).

Unauthenticated attackers can exploit this vulnerability remotely over the network with low attack complexity and no user interaction required. Successful exploitation grants limited impacts, including low-level access to confidentiality, integrity, and availability of affected systems.

Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/a2z-fedex-shipping/vulnerability/wordpress-automated-fedex-live-manual-rates-with-shipping-labels-plugin-5-1-8-broken-access-control-vulnerability?_s_id=cve.

Details

CWE(s)

CVEs Like This One

CVE-2025-67974Shared CWE-862
CVE-2026-28254Shared CWE-862
CVE-2026-3266Shared CWE-862
CVE-2025-69297Shared CWE-862
CVE-2025-69186Shared CWE-862
CVE-2025-13493Shared CWE-862
CVE-2026-30968Shared CWE-862
CVE-2025-69191Shared CWE-862
CVE-2026-24368Shared CWE-862
CVE-2025-39477Shared CWE-862

References