CVE-2025-23849

WordPress PAPERCITE plugin <= 0.5.18 - Broken Access Control vulnerability

View on CVE.org
Published Jan 27, 2025 CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Description
Missing Authorization vulnerability in bpiwowar PAPERCITE papercite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PAPERCITE: from n/a through <= 0.5.18.

Analysis

AI-generated

Technical impact

The vulnerability involves a missing Authorization check in the PAPERCITE plugin for WordPress. Because the plugin does not enforce proper access control, an attacker could potentially manipulate plugin functionality or data that should be restricted to privileged users, thereby compromising the integrity of the site content and potentially exposing sensitive information through the plugin interface. The weakness is identified as CWE-862, indicating Incorrect Authorization.

Affected Systems

This issue affects the WordPress PAPERCITE plugin, version 0.5.18 and earlier, from the first release onward. Administrators of WordPress sites using any of these versions should verify the installed plugin version and upgrade if necessary.

Risk and Exploitability

The CVSS score of 5.4 suggests moderate severity. The EPSS score of less than 1% indicates a very low but non-zero probability of exploitation at the time of analysis. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is remote, as the plugin is exposed through the web interface of a WordPress site; however, the exact path is inferred from the nature of the vulnerability and is not explicitly stated in the provided description.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the PAPERCITE plugin to a version newer than 0.5.18 or to the latest available release.
  • Revalidate the plugin’s configuration to ensure that only authorized user roles can access and modify plugin-related settings.
  • Audit user accounts and permissions on the WordPress site to detect any unauthorized changes or newly created administrative accounts.

Generated by OpenCVE AI on May 1, 2026 at 18:14 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2025-3474 Missing Authorization vulnerability in Benjamin Piwowarski PAPERCITE allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects PAPERCITE: from n/a through 0.5.18.
History
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L'}
Type Values Removed Values Added
Description Missing Authorization vulnerability in Benjamin Piwowarski PAPERCITE allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects PAPERCITE: from n/a through 0.5.18. Missing Authorization vulnerability in bpiwowar PAPERCITE papercite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PAPERCITE: from n/a through <= 0.5.18.
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L'}
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Missing Authorization vulnerability in Benjamin Piwowarski PAPERCITE allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects PAPERCITE: from n/a through 0.5.18.
Title WordPress PAPERCITE plugin <= 0.5.18 - Broken Access Control vulnerability
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L'}
Weaknesses

Sources

Status
PUBLISHED
Assigner
Patchstack
Published
Updated
May 11, 2026, 11:22 PM
Reserved
Jan 16, 2025, 11:31 AM

View source JSON

Updated
Jan 27, 2025, 2:58 PM

JSON

Status
Deferred
Published
Jan 27, 2025, 3:15 PM
Modified
Jun 17, 2026, 8:57 AM

View source JSON

No data.

Updated
May 1, 2026, 6:15 PM

JSON