CVE-2025-69303

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-69303", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2025-12-31T20:12:02.742Z", "datePublished": "2026-02-20T15:46:47.100Z", "dateUpdated": "2026-04-28T16:14:37.084Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "modeltheme-framework", "product": "ModelTheme Framework", "vendor": "modeltheme", "versions": [{"changes": [{"at": "2.0.0", "status": "unaffected"}], "lessThanOrEqual": "2.0.0", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Phat RiO | Patchstack Bug Bounty Program"}], "datePublic": "2026-04-22T14:20:48.144Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Missing Authorization vulnerability in modeltheme ModelTheme Framework modeltheme-framework allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects ModelTheme Framework: from n/a through < 2.0.0.</p>"}], "value": "Missing Authorization vulnerability in modeltheme ModelTheme Framework modeltheme-framework allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ModelTheme Framework: from n/a through < 2.0.0."}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "Missing Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-28T16:14:37.084Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/modeltheme-framework/vulnerability/wordpress-modeltheme-framework-plugin-1-9-2-broken-access-control-vulnerability?_s_id=cve"}], "title": "WordPress ModelTheme Framework plugin < 2.0.0 - Broken Access Control vulnerability"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-25T15:50:29.171780Z", "id": "CVE-2025-69303", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-27T19:50:08.035Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-69303", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-25T15:50:29.171780Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-25T15:48:33.924Z"}}], "cna": {"title": "WordPress ModelTheme Framework plugin < 2.0.0 - Broken Access Control vulnerability", "credits": [{"lang": "en", "type": "finder", "value": "Phat RiO | Patchstack Bug Bounty Program"}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "modeltheme", "product": "ModelTheme Framework", "versions": [{"status": "affected", "changes": [{"at": "2.0.0", "status": "unaffected"}], "version": "0", "versionType": "custom", "lessThanOrEqual": "2.0.0"}], "packageName": "modeltheme-framework", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}], "datePublic": "2026-04-22T14:20:48.144Z", "references": [{"url": "https://patchstack.com/database/Wordpress/Plugin/modeltheme-framework/vulnerability/wordpress-modeltheme-framework-plugin-1-9-2-broken-access-control-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in modeltheme ModelTheme Framework modeltheme-framework allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ModelTheme Framework: from n/a through < 2.0.0.", "supportingMedia": [{"type": "text/html", "value": "Missing Authorization vulnerability in modeltheme ModelTheme Framework modeltheme-framework allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects ModelTheme Framework: from n/a through < 2.0.0.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "Missing Authorization"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-23T14:14:00.716Z"}}}, "cveMetadata": {"cveId": "CVE-2025-69303", "state": "PUBLISHED", "dateUpdated": "2026-04-27T19:50:08.035Z", "dateReserved": "2025-12-31T20:12:02.742Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2026-02-20T15:46:47.100Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "modeltheme-framework", "product": "ModelTheme Framework", "vendor": "modeltheme", "versions": [{"changes": [{"at": "2.0.0", "status": "unaffected"}], "lessThanOrEqual": "2.0.0", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "audit@patchstack.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in modeltheme ModelTheme Framework modeltheme-framework allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ModelTheme Framework: from n/a through < 2.0.0."}, {"lang": "es", "value": "Vulnerabilidad por falta de autorizaci\u00f3n en modeltheme ModelTheme Framework modeltheme-framework permite la explotaci\u00f3n de niveles de seguridad de control de acceso configurados incorrectamente. Este problema afecta a ModelTheme Framework: desde n/a hasta &lt;= 1.9.2."}], "id": "CVE-2025-69303", "lastModified": "2026-06-17T10:00:27.463", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "audit@patchstack.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-69303", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-25T15:50:29.171780Z", "version": "2.0.3"}}]}, "published": "2026-02-20T16:22:18.243", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/Wordpress/Plugin/modeltheme-framework/vulnerability/wordpress-modeltheme-framework-plugin-1-9-2-broken-access-control-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "audit@patchstack.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.9.2]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "ModelTheme Framework", "source": "cna", "vendor": "modeltheme"}, "product": "modeltheme_framework", "vendor": "modeltheme"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-28T17:39:31.254474+00:00", "value": {"mitigation_remediation": ["Apply the latest version of the ModelTheme Framework plugin (2.0.0 or newer) to eliminate the missing authorization checks.", "If an immediate update is not feasible, disable the plugin or restrict its administrative URLs to trusted users only until the patch is applied.", "Enforce strict role\u2011based access control on the WordPress installation, ensuring that only users with administrator privileges can reach the plugin\u2019s functionalities, to mitigate accidental exposure."], "summary": {"action": "Patch", "impact": "Unauthorized access to privileged plugin functions"}, "threat_synthesis": {"affected_systems": "WordPress sites running the ModelTheme Framework plugin version prior to 2.0.0 are affected. The vendor is ModelTheme and the affected product is the ModelTheme Framework. Any installation using an older release is vulnerable.", "description_and_impact": "ModelTheme Framework for WordPress contains a missing authorization flaw that enables exploitation of incorrectly configured access control security levels. The vulnerability permits an attacker to reach functionality reserved for administrators, allowing reading or modifying site data, uploading files, or executing arbitrary actions that would normally be restricted. Although the description does not state the exact vector, it is reasonable to assume the flaw is exploitable through crafted HTTP requests to the plugin\u2019s endpoints.", "risk_and_exploitability": "The CVSS base score of 7.5 indicates a high severity, while the EPSS score of less than 1% suggests that exploitation is currently unlikely to occur. The vulnerability is not listed in the CISA KEV catalog. Based on the nature of the flaw, an attacker could gain unauthorized access to the plugin\u2019s administrative paths; exploitation would not require specialized skills beyond sending a crafted request, and could be performed remotely if the plugin\u2019s endpoints are publicly reachable."}}}}, "created": "2026-02-23T14:37:41.782863+00:00", "updated": "2026-04-28T17:45:16.135505+00:00", "vendors": ["modeltheme", "modeltheme$PRODUCT$modeltheme_framework", "wordpress", "wordpress$PRODUCT$wordpress"]}