PT-2025-15923 · WordPress · Embedder

Kenneth Dunn · Published 2025-04-10 · Updated 2025-04-10 · CVE-2025-3417

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Embedder plugin for WordPress versions 1.3 to 1.3.5

Description: The issue allows unauthorized modification of data, leading to privilege escalation due to a missing capability check on the ajax set global option() function. This enables authenticated attackers with Subscriber-level access and above to update arbitrary options on the WordPress site, potentially allowing them to gain administrative user access.

Recommendations: For Embedder plugin for WordPress versions 1.3 to 1.3.5, consider disabling the ajax set global option() function until a patch is available to prevent unauthorized modification of data. Restrict access to the plugin's functionality to minimize the risk of exploitation. Avoid using the affected plugin until the issue is resolved.

Fix

LPE

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-3417

Affected Products

Embedder

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-3417 · Security Note
• https://twitter.com/vulns_space/status/1910233842109100358 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1910249819269890087 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/fa86bcb9-e558-4b60-9473-65cd6f9663fd?source=cve · Note
• https://twitter.com/CVEnew/status/1910296106300477692 · Twitter Post
• https://t.me/latest_high_impact_cve/2124 · Telegram Post
• https://twitter.com/cybercronai/status/1910475559781400886 · Twitter Post
• https://plugins.trac.wordpress.org/browser/embedder/trunk/emb-admin-ajax.php#L41 · Note