CVE-2026-25021

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25021", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-01-28T09:51:55.183Z", "datePublished": "2026-02-03T14:08:40.392Z", "dateUpdated": "2026-04-28T16:14:54.203Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "mizan-demo-importer", "product": "Mizan Demo Importer", "vendor": "Mizan Themes", "versions": [{"changes": [{"at": "0.1.4", "status": "unaffected"}], "lessThanOrEqual": "0.1.3", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Nabil Irawan | Patchstack Bug Bounty Program"}], "datePublic": "2026-04-01T16:04:59.715Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Missing Authorization vulnerability in Mizan Themes Mizan Demo Importer mizan-demo-importer allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Mizan Demo Importer: from n/a through <= 0.1.3.</p>"}], "value": "Missing Authorization vulnerability in Mizan Themes Mizan Demo Importer mizan-demo-importer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mizan Demo Importer: from n/a through <= 0.1.3."}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "Missing Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-28T16:14:54.203Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/mizan-demo-importer/vulnerability/wordpress-mizan-demo-importer-plugin-0-1-3-broken-access-control-vulnerability?_s_id=cve"}], "title": "WordPress Mizan Demo Importer plugin <= 0.1.3 - Broken Access Control vulnerability"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-03T16:13:08.926032Z", "id": "CVE-2026-25021", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-28T12:48:50.574Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-25021", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-03T16:13:08.926032Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-03T16:13:04.428Z"}}], "cna": {"title": "WordPress Mizan Demo Importer plugin <= 0.1.3 - Broken Access Control vulnerability", "credits": [{"lang": "en", "type": "finder", "value": "Nabil Irawan | Patchstack Bug Bounty Program"}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "affected": [{"vendor": "Mizan Themes", "product": "Mizan Demo Importer", "versions": [{"status": "affected", "changes": [{"at": "0.1.4", "status": "unaffected"}], "version": "n/a", "versionType": "custom", "lessThanOrEqual": "<= 0.1.3"}], "packageName": "mizan-demo-importer", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}], "datePublic": "2026-02-02T15:56:49.062Z", "references": [{"url": "https://patchstack.com/database/Wordpress/Plugin/mizan-demo-importer/vulnerability/wordpress-mizan-demo-importer-plugin-0-1-3-broken-access-control-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in Mizan Themes Mizan Demo Importer mizan-demo-importer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mizan Demo Importer: from n/a through <= 0.1.3.", "supportingMedia": [{"type": "text/html", "value": "Missing Authorization vulnerability in Mizan Themes Mizan Demo Importer mizan-demo-importer allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Mizan Demo Importer: from n/a through <= 0.1.3.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "Missing Authorization"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-02-03T14:08:40.392Z"}}}, "cveMetadata": {"cveId": "CVE-2026-25021", "state": "PUBLISHED", "dateUpdated": "2026-02-03T16:13:12.772Z", "dateReserved": "2026-01-28T09:51:55.183Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2026-02-03T14:08:40.392Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "mizan-demo-importer", "product": "Mizan Demo Importer", "vendor": "Mizan Themes", "versions": [{"changes": [{"at": "0.1.4", "status": "unaffected"}], "lessThanOrEqual": "0.1.3", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "audit@patchstack.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in Mizan Themes Mizan Demo Importer mizan-demo-importer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mizan Demo Importer: from n/a through <= 0.1.3."}, {"lang": "es", "value": "Vulnerabilidad de falta de autorizaci\u00f3n en Mizan Themes Mizan Demo Importer mizan-demo-importer permite la explotaci\u00f3n de niveles de seguridad de control de acceso configurados incorrectamente. Este problema afecta a Mizan Demo Importer: desde n/a hasta &lt;= 0.1.3."}], "id": "CVE-2026-25021", "lastModified": "2026-06-17T10:23:59.773", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "audit@patchstack.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25021", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-03T16:13:08.926032Z", "version": "2.0.3"}}]}, "published": "2026-02-03T15:16:20.380", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/Wordpress/Plugin/mizan-demo-importer/vulnerability/wordpress-mizan-demo-importer-plugin-0-1-3-broken-access-control-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "audit@patchstack.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-16T01:10:05.885914+00:00", "value": {"mitigation_remediation": ["Update the Mizan Demo Importer plugin to the latest release, ensuring the version is newer than 0.1.3.", "If no update is available, disable or delete the plugin to eliminate the vulnerability.", "Add a capability check to the import code so that only administrators can invoke it, or apply a restrictive .htaccess rule to block direct access to the plugin's import endpoint."], "summary": {"action": "Apply Patch", "impact": "Unauthorized Access to Demo Import Functionality"}, "threat_synthesis": {"affected_systems": "Product: Mizan Themes Mizan Demo Importer plugin. Affected before and including version 0.1.3. No further version data available.", "description_and_impact": "The Mizan Demo Importer plugin contains a missing authorization flaw that allows an attacker to invoke its import functionality without proper privileges. This weakness, identified as CWE\u2011862, means that any user who can reach the import interface can trigger it and potentially upload or activate demo content, leading to unauthorized data manipulation or site compromise.", "risk_and_exploitability": "The vulnerability scores a CVSS of 5.4, indicating moderate severity, while its EPSS score of less than 1% suggests a low likelihood of exploitation in the current landscape. It is not listed in the CISA KEV catalog. The attack surface is most likely a publicly accessible WordPress site where the plugin is active; an adversary could exploit the lack of access control by crafting a request to the import endpoint. Successful exploitation would grant unauthorized access to the import capability, which could be leveraged for broader site misuse."}}}}, "created": "2026-02-04T12:09:27.698158+00:00", "updated": "2026-04-16T01:15:20.533700+00:00", "vendors": ["mizan_themes", "mizan_themes$PRODUCT$mizan_demo_importer", "wordpress", "wordpress$PRODUCT$wordpress"]}