Description
Missing Authorization vulnerability in Jeremy Saxey Hide WP Toolbar hide-wp-toolbar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hide WP Toolbar: from n/a through <= 2.7.
Published: 2025-09-22
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is a missing authorization flaw that lets a user bypass incorrectly configured access controls and potentially use the Hide WP Toolbar plugin with elevated privileges. It is classified as CWE-862, indicating that the plugin failed to enforce proper role checks before allowing access.

Affected Systems

The issue affects the WordPress Hide WP Toolbar plugin developed by Jeremy Saxey, versions from the earliest releases through 2.7 and earlier. Any WordPress installation that has this plugin installed and has not applied an update beyond 2.7 is potentially affected.

Risk and Exploitability

The CVSS score of 4.3 reflects moderate severity. The EPSS score is below 1%, suggesting a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Exploitation likely requires access to a user account that can interact with the plugin, and the improper access control allows that account to perform actions normally restricted to administrators. The risk remains if the website permits any authenticated user to load the plugin interface or if the plugin is exposed via public URLs.

Generated by OpenCVE AI on April 30, 2026 at 00:56 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the Hide WP Toolbar plugin to the latest available version or disable it if the functionality is not needed.
  • Ensure that only administrator roles are granted access to the plugin’s administrative screens by reviewing WordPress role capabilities and removing any custom role mappings that could lower permissions.
  • If an update is not available, restrict the plugin’s access by placing the plugin’s directory behind authentication or by using a security plugin to block non‑admin users from loading it.
  • Verify that no other plugins or custom code override WordPress’s default role checks, and audit the site’s role configuration for unexpected privilege assignments.

Generated by OpenCVE AI on April 30, 2026 at 00:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-30634 Missing Authorization vulnerability in Jeremy Saxey Hide WP Toolbar allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Hide WP Toolbar: from n/a through 2.7.
History

Thu, 23 Apr 2026 15:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'}

Wed, 01 Apr 2026 23:45:00 +0000

Type Values Removed Values Added
Description Missing Authorization vulnerability in Jeremy Saxey Hide WP Toolbar allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Hide WP Toolbar: from n/a through 2.7. Missing Authorization vulnerability in Jeremy Saxey Hide WP Toolbar hide-wp-toolbar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hide WP Toolbar: from n/a through <= 2.7.
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'}

Tue, 23 Sep 2025 16:15:00 +0000

Type Values Removed Values Added
First Time appeared Wordpress
Wordpress wordpress
Vendors & Products Wordpress
Wordpress wordpress

Tue, 23 Sep 2025 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 22 Sep 2025 18:30:00 +0000

Type Values Removed Values Added
Description Missing Authorization vulnerability in Jeremy Saxey Hide WP Toolbar allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Hide WP Toolbar: from n/a through 2.7.
Title WordPress Hide WP Toolbar Plugin <= 2.7 - Broken Access Control Vulnerability
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'}

Subscriptions

Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-04-28T16:13:39.693Z

Reserved: 2025-08-22T11:37:02.929Z

Link: CVE-2025-57969

cve-icon Vulnrichment

Updated: 2025-09-23T14:27:29.498Z

cve-icon NVD

Status : Deferred

Published: 2025-09-22T19:15:56.313

Modified: 2026-04-23T15:33:09.127

Link: CVE-2025-57969

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-30T01:00:13Z

Weaknesses