PT-2025-43594 · WordPress · Supervisor Plugin

Published 2025-10-24 · Updated 2025-10-24 · CVE-2025-11887

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions WordPress Supervisor Plugin versions up to and including 1.3.2

Description The Supervisor plugin for WordPress is susceptible to unauthorized data modification. This is due to a missing capability check in multiple AJAX functions. Authenticated attackers with Subscriber-level access or higher can modify various plugin settings. The affected API endpoints are not specified. The vulnerable parameters or variables are not specified. The vulnerable function is not specified.

Recommendations Update the Supervisor plugin to a version later than 1.3.2.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-11887

Affected Products

Supervisor Plugin

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-11887 · Security Note
• https://twitter.com/VulmonFeeds/status/1981673876393173024 · Twitter Post
• https://twitter.com/CVEnew/status/1981643772862558536 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/2d3e2880-bb86-4263-9ed4-25a9769890e4?source=cve · Note
• https://t.me/CVEtracker/35653 · Telegram Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3383178%40supervisor&new=3383178%40supervisor&sfp_email=&sfph_mail= · Note