PT-2025-42704 · WordPress · Powerbi Embed Reports

Published 2025-10-18 · Updated 2025-10-18 · CVE-2025-10750

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions PowerBI Embed Reports plugin for WordPress versions prior to 1.2.1

Description The PowerBI Embed Reports plugin for WordPress is susceptible to unauthorized disclosure of sensitive information. This is a result of inadequate capability checks and authentication verification on the testUser API endpoint. Attackers do not need to be authenticated to access sensitive Azure AD user information, including personally identifiable information (PII) such as displayName, mail, phones, and department. Additionally, detailed OAuth error data, including Azure AD Application/Client IDs, error codes, trace IDs, and correlation IDs, can be accessed. The issue is related to the mo epbr admin observer() function hooked on the 'init' action.

Recommendations Update the PowerBI Embed Reports plugin to version 1.2.1 or later.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2025-10750

Affected Products

Powerbi Embed Reports

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-10750 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/d830c2eb-16e8-425c-ac46-a467a2fd0133?source=cve · Note
• https://plugins.trac.wordpress.org/browser/embed-power-bi-reports/tags/1.2.0/Observer/adminObserver.php#L54 · Note
• https://twitter.com/VulmonFeeds/status/1979507159827124581 · Twitter Post
• https://twitter.com/CVEnew/status/1979451666848973092 · Twitter Post
• https://plugins.trac.wordpress.org/browser/embed-power-bi-reports/tags/1.2.0/Observer/adminObserver.php#L265 · Note
• https://plugins.trac.wordpress.org/browser/embed-power-bi-reports/tags/1.2.0/embed-microsoft-power-bi-reports.php#L75 · Note
• https://t.me/cveNotify/139332 · Telegram Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3369956%40embed-power-bi-reports&new=3369956%40embed-power-bi-reports&sfp_email=&sfph_mail= · Note
• https://t.me/CVEtracker/35274 · Telegram Post