CVE-2025-48350

WordPress AutoWP plugin <= 2.2.7 - Broken Access Control vulnerability

View on CVE.org
Published Aug 28, 2025 CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Description
Missing Authorization vulnerability in Basar Ventures AutoWP autowp-ai-content-writer-rewriter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AutoWP: from n/a through <= 2.2.7.

Analysis

AI-generated

Technical impact

The vulnerability is a missing authorization flaw in the AutoWP plugin developed by Basar Ventures. It allows attackers to bypass intended access controls and exploit incorrectly configured security levels within the plugin. The weakness aligns with CWE‑862, meaning any entity that should be restricted can gain unauthorized access to privileged plugin functionality.

Affected Systems

All versions of the AutoWP plugin up to and including version 2.2.7 are affected. The plugin is distributed by Basar Ventures under the name AutoWP.

Risk and Exploitability

The CVSS score of 4.3 indicates moderate impact, while the EPSS score of less than 1% shows a low probability that the vulnerability is widely exploited. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote through the WordPress site, where an attacker could interact with the plugin’s endpoints or features without possessing proper permissions. Exploitation requires that the vulnerability exists in the deployed plugin instance and that the plugin is accessible to the attacker. No additional exploitation prerequisites are documented in the provided data.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the AutoWP plugin to version 2.2.8 or later once the update is available.
  • If an update is not yet available, temporarily disable the AutoWP plugin to eliminate the exposed functionality.
  • Review and enforce WordPress role and capability settings so that only authorized user roles can access AutoWP features.

Generated by OpenCVE AI on April 30, 2026 at 07:49 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2025-26028 Missing Authorization vulnerability in Neuralabz LTD AutoWP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects AutoWP: from n/a through 2.2.2.
History
Type Values Removed Values Added
Description Missing Authorization vulnerability in Basar Ventures AutoWP autowp-ai-content-writer-rewriter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AutoWP: from n/a through <= 2.2.8. Missing Authorization vulnerability in Basar Ventures AutoWP autowp-ai-content-writer-rewriter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AutoWP: from n/a through <= 2.2.7.
Title WordPress AutoWP plugin <= 2.2.8 - Broken Access Control vulnerability WordPress AutoWP plugin <= 2.2.7 - Broken Access Control vulnerability
Type Values Removed Values Added
Description Missing Authorization vulnerability in Basar Ventures AutoWP autowp-ai-content-writer-rewriter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AutoWP: from n/a through <= 2.2.7. Missing Authorization vulnerability in Basar Ventures AutoWP autowp-ai-content-writer-rewriter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AutoWP: from n/a through <= 2.2.8.
Title WordPress AutoWP plugin <= 2.2.7 - Broken Access Control vulnerability WordPress AutoWP plugin <= 2.2.8 - Broken Access Control vulnerability
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'}
Type Values Removed Values Added
Description Missing Authorization vulnerability in Neuralabz LTD AutoWP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects AutoWP: from n/a through 2.2.2. Missing Authorization vulnerability in Basar Ventures AutoWP autowp-ai-content-writer-rewriter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AutoWP: from n/a through <= 2.2.7.
Title WordPress AutoWP plugin <= 2.2.2 - Broken Access Control vulnerability WordPress AutoWP plugin <= 2.2.7 - Broken Access Control vulnerability
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'}
Type Values Removed Values Added
First Time appeared Wordpress
Wordpress wordpress
Vendors & Products Wordpress
Wordpress wordpress
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Missing Authorization vulnerability in Neuralabz LTD AutoWP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects AutoWP: from n/a through 2.2.2.
Title WordPress AutoWP plugin <= 2.2.2 - Broken Access Control vulnerability
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'}
Earlier changes (1)
Weaknesses

Sources

Status
PUBLISHED
Assigner
Patchstack
Published
Updated
Apr 28, 2026, 4:12 PM
Reserved
May 19, 2025, 2:41 PM

View source JSON

Updated
Aug 28, 2025, 5:41 PM

JSON

Status
Deferred
Published
Aug 28, 2025, 1:15 PM
Modified
Oct 18, 2026, 9:10 PM

View source JSON

No data.

Updated
Apr 30, 2026, 8:00 AM

JSON