CVE-2025-10750: PowerBI Embed Reports Info Disclosure

CVE-2025-10750 Overview

The PowerBI Embed Reports plugin for WordPress contains a sensitive information disclosure vulnerability affecting all versions up to and including 1.2.0. The flaw resides in the testUser endpoint, which is exposed through the mo_epbr_admin_observer() function hooked on WordPress init. The endpoint lacks capability checks and authentication verification, allowing unauthenticated attackers to query Azure Active Directory user data and OAuth diagnostic information over the network. Exposed data includes personally identifiable information (PII) such as displayName, mail, phone numbers, and department, along with Azure AD Application/Client IDs, error codes, trace IDs, and correlation IDs. This weakness is classified under [CWE-200: Exposure of Sensitive Information to an Unauthorized Actor].

Critical Impact
Unauthenticated remote attackers can enumerate Azure AD user PII and harvest OAuth diagnostic identifiers useful for follow-on attacks against Microsoft identity infrastructure.

Affected Products

WordPress PowerBI Embed Reports plugin (slug: embed-power-bi-reports) versions ≤ 1.2.0
WordPress sites integrating Microsoft Power BI report embedding via this plugin
Azure AD tenants linked to affected WordPress installations

Discovery Timeline

2025-10-18 - CVE-2025-10750 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10750

Vulnerability Analysis

The vulnerability is a broken access control issue in the plugin's administrative observer routine. The mo_epbr_admin_observer() function is registered against WordPress's init action, meaning it executes on every request regardless of authentication state. Inside that handler, the plugin routes a testUser action to logic that queries Microsoft Graph and returns Azure AD user attributes to the requester. Because the code path performs no current_user_can() capability check and no nonce or authentication verification, any anonymous visitor can invoke the endpoint. The response body contains PII sourced from Azure AD and, on failure paths, verbose OAuth error objects revealing tenant and application identifiers.

Root Cause

The root cause is missing authorization enforcement on a privileged administrative code path. The init hook fires before WordPress evaluates the requester's role or admin context, and the plugin author did not add compensating checks inside mo_epbr_admin_observer(). The testUser branch was intended as an admin diagnostic tool but was reachable by unauthenticated users because the handler trusted the presence of request parameters instead of validating the caller. See the WordPress Plugin Code Review at line 265 and the handler registration at line 54 for the vulnerable source.

Attack Vector

An attacker sends a crafted HTTP GET or POST request to the vulnerable WordPress site targeting the testUser action processed by mo_epbr_admin_observer(). No authentication, session cookie, or user interaction is required. The server-side handler forwards the request to Microsoft Graph using the plugin's stored OAuth credentials and returns the response body to the attacker. Successful exploitation yields Azure AD user records; failure paths still leak Application/Client IDs, trace IDs, and correlation IDs that support tenant reconnaissance. Details are documented in the Wordfence Vulnerability Report.

Detection Methods for CVE-2025-10750

Indicators of Compromise

Unauthenticated HTTP requests to the WordPress site containing the testUser parameter or action targeting the PowerBI Embed Reports plugin.
Outbound requests from the WordPress host to graph.microsoft.com immediately following anonymous inbound traffic.
Web server access logs showing responses with JSON payloads containing displayName, mail, or Azure AD correlation_id values returned to public clients.

Detection Strategies

Inventory WordPress deployments for the embed-power-bi-reports plugin at version 1.2.0 or earlier and flag any exposed installations.
Deploy web application firewall rules that inspect query strings and POST bodies for the testUser action pattern targeting the plugin path.
Correlate WordPress access logs with Azure AD sign-in and audit logs to detect anomalous Graph API activity originating from the plugin's service principal.

Monitoring Recommendations

Alert on any Microsoft Graph /users query initiated by the plugin's Azure AD Application ID outside of normal admin working hours.
Monitor Azure AD sign-in logs for unusual correlation_id or trace_id values referenced in external reconnaissance activity.
Track HTTP response sizes from the plugin endpoint; large JSON responses to unauthenticated clients indicate active exploitation.

How to Mitigate CVE-2025-10750

Immediate Actions Required

Update the PowerBI Embed Reports plugin to a version later than 1.2.0 that includes the fix documented in the WordPress Plugin Changeset 3369956.
Rotate the Azure AD Application client secret used by the plugin to invalidate any credentials that may have been observed through leaked OAuth diagnostics.
Review Azure AD audit logs for anomalous Microsoft Graph queries originating from the plugin's service principal.

Patch Information

The vendor addressed the missing authorization check in the changeset referenced above. The fix adds capability verification before the testUser handler processes the request. Administrators should confirm the installed plugin version is greater than 1.2.0 after applying the update. Additional technical context is available in the handler entry point source at line 75.

Workarounds

Deactivate and remove the PowerBI Embed Reports plugin until the site can be updated to a patched release.
Restrict access to the WordPress /wp-admin/ and plugin endpoints behind IP allowlisting or a reverse proxy authentication layer.
Scope the Azure AD Application permissions granted to the plugin down to the minimum required for report embedding and revoke User.Read.All or similar broad Graph scopes.

bash

# Configuration example: disable the vulnerable plugin via WP-CLI
wp plugin deactivate embed-power-bi-reports
wp plugin delete embed-power-bi-reports