CVE-2025-24653

WordPress Admin and Site Enhancements (ASE) Pro Plugin <= 7.6.1.1 - Broken Access Control vulnerability

Published Jan 27, 2025 CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Description

Missing Authorization vulnerability in NotFound Admin and Site Enhancements (ASE) Pro allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Admin and Site Enhancements (ASE) Pro: from n/a through 7.6.1.1.

Analysis

Technical impact

A missing authorization flaw in the WordPress Admin and Site Enhancements (ASE) Pro plugin enables attackers to perform actions normally reserved for privileged users. Classified as CWE‑862, the weakness means the plugin fails to enforce proper permission checks, allowing an unauthorized actor to read or modify critical site settings, potentially exposing configuration data or facilitating further exploitation.

Affected Systems

The vulnerability applies to the NotFound Admin and Site Enhancements (ASE) Pro WordPress plugin in all releases up through version 7.6.1.1. Any WordPress site running a vulnerable version is at risk until the plugin is upgraded.

Risk and Exploitability

The CVSS score of 4.3 indicates moderate severity, while the EPSS of less than 1% reflects a low probability of exploitation today. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is through the plugin’s administrative interface, where a user without proper privileges can invoke routes that bypass authorization and elevate their permissions on the WordPress site.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

NotFound

Admin and Site Enhancements (ASE) Pro

unaffected

Version	Status	Constraints
`n/a`	affected	≤ 7.6.1.1

No data.

No data available yet.

Remediation

Vendor Solution

Update the WordPress Admin and Site Enhancements (ASE) Pro wordpress plugin to the latest available version (at least 7.6.3).

OpenCVE Recommended Actions

Update the WordPress Admin and Site Enhancements (ASE) Pro plugin to version 7.6.3 or later.
Review and restrict user roles so that only legitimate administrators can access ASE Pro administrative features.
Enable two‑factor authentication for WordPress admin accounts to reduce the impact of compromised credentials.

Generated by OpenCVE AI on May 2, 2026 at 11:18 UTC.

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2025-3850	Missing Authorization vulnerability in NotFound Admin and Site Enhancements (ASE) Pro allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Admin and Site Enhancements (ASE) Pro: from n/a through 7.6.1.1.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.244% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://patchstack.com/database/wordpress/plugin/admin-site-enhancements-pro/vulnerability/wordpress-admin-and-site-enhancements-ase-pro-plugin-7-6-1-1-broken-access-control-vulnerability?_s_id=cve

History

Nov 10, 2026 9:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Apr 28, 2026 7:30 PM References updated View changes

Type	Values Removed	Values Added
References	https://patchstack.com/database/Wordpress/Plugin/admin-site-enhancements-pro/vulnerability/wordpress-admin-and-site-enhancements-ase-pro-plugin-7-6-1-1-broken-access-control-vulnerability?_s_id=cve

Apr 28, 2026 6:30 PM Description updated. Added references View changes

Type	Values Removed	Values Added
Description	Missing Authorization vulnerability in NotFound Admin and Site Enhancements (ASE) Pro admin-site-enhancements-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Admin and Site Enhancements (ASE) Pro: from n/a through <= 7.6.1.1.	Missing Authorization vulnerability in NotFound Admin and Site Enhancements (ASE) Pro allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Admin and Site Enhancements (ASE) Pro: from n/a through 7.6.1.1.
References		https://patchstack.com/database/wordpress/plugin/admin-site-enhancements-pro/vulnerability/wordpress-admin-and-site-enhancements-ase-pro-plugin-7-6-1-1-broken-access-control-vulnerability?_s_id=cve

Apr 23, 2026 3:30 PM References updated View changes

Type	Values Removed	Values Added
References	https://patchstack.com/database/wordpress/plugin/admin-site-enhancements-pro/vulnerability/wordpress-admin-and-site-enhancements-ase-pro-plugin-7-6-1-1-broken-access-control-vulnerability?_s_id=cve

Apr 23, 2026 3:00 PM Description updated. Added references View changes

Type	Values Removed	Values Added
Description	Missing Authorization vulnerability in NotFound Admin and Site Enhancements (ASE) Pro allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Admin and Site Enhancements (ASE) Pro: from n/a through 7.6.1.1.	Missing Authorization vulnerability in NotFound Admin and Site Enhancements (ASE) Pro admin-site-enhancements-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Admin and Site Enhancements (ASE) Pro: from n/a through <= 7.6.1.1.
References		https://patchstack.com/database/Wordpress/Plugin/admin-site-enhancements-pro/vulnerability/wordpress-admin-and-site-enhancements-ase-pro-plugin-7-6-1-1-broken-access-control-vulnerability?_s_id=cve

Jan 27, 2025 2:30 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Missing Authorization vulnerability in NotFound Admin and Site Enhancements (ASE) Pro allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Admin and Site Enhancements (ASE) Pro: from n/a through 7.6.1.1.
Title		WordPress Admin and Site Enhancements (ASE) Pro Plugin <= 7.6.1.1 - Broken Access Control vulnerability
Weaknesses		CWE-862
References		https://patchstack.com/database/wordpress/plugin/admin-site-enhancements-pro/vulnerability/wordpress-admin-and-site-enhancements-ase-pro-plugin-7-6-1-1-broken-access-control-vulnerability?_s_id=cve
Metrics		cvssV3_1 `{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'}`