CVE-2025-28874

Authorization Bypass Through User-Controlled Key vulnerability in shanebp BP Email Assign Templates bp-email-assign-templates allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BP Email Assign Templates: from n/a through <= 1.7.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.2 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://patchstack.com/database/Wordpress/Plugin/bp-email-assign-templates/vulnerability/wordpress-bp-email-assign-templates-by-shanebp-plugin-1-6-arbitrary-content-deletion-vulnerability?_s_id=cve	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:shanebp:bp_email_assign_templates:*:*:*:*:*:wordpress:*:*

History

No history.

Information

Published : 2025-03-11 21:15

Updated : 2026-06-17 09:04

NVD link : CVE-2025-28874

Mitre link : CVE-2025-28874

CVE.ORG link : CVE-2025-28874

JSON object : View

Products Affected

shanebp

bp_email_assign_templates

CWE

CWE-639

Authorization Bypass Through User-Controlled Key

{"id": "CVE-2025-28874", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-28874", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-03-12T13:45:31.805989Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "audit@patchstack.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 5.2, "exploitabilityScore": 1.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.2}]}, "affected": [{"source": "audit@patchstack.com", "affectedData": [{"vendor": "shanebp", "product": "BP Email Assign Templates", "versions": [{"status": "affected", "changes": [{"at": "1.8", "status": "unaffected"}], "version": "0", "versionType": "custom", "lessThanOrEqual": "1.7"}], "packageName": "bp-email-assign-templates", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}]}], "published": "2025-03-11T21:15:44.907", "references": [{"url": "https://patchstack.com/database/Wordpress/Plugin/bp-email-assign-templates/vulnerability/wordpress-bp-email-assign-templates-by-shanebp-plugin-1-6-arbitrary-content-deletion-vulnerability?_s_id=cve", "tags": ["Third Party Advisory"], "source": "audit@patchstack.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "audit@patchstack.com", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "Authorization Bypass Through User-Controlled Key vulnerability in shanebp BP Email Assign Templates bp-email-assign-templates allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BP Email Assign Templates: from n/a through <= 1.7."}, {"lang": "es", "value": "La vulnerabilidad de omisi\u00f3n de autorizaci\u00f3n mediante clave controlada por el usuario en shanebp BP Email Assign Templates permite explotar niveles de seguridad de control de acceso configurados incorrectamente. Este problema afecta a las plantillas de asignaci\u00f3n de correo electr\u00f3nico de BP desde n/d hasta la versi\u00f3n 1.6."}], "lastModified": "2026-06-17T09:04:48.397", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:shanebp:bp_email_assign_templates:*:*:*:*:*:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "234B064A-8963-4D6D-B4E9-80684F345C10", "versionEndExcluding": "1.8"}], "operator": "OR"}]}], "sourceIdentifier": "audit@patchstack.com"}