CVE-2025-24589: JSM Show Post Metadata Auth Bypass Flaw

CVE-2025-24589 is an authorization bypass vulnerability in the JSM Show Post Metadata WordPress plugin that enables unauthorized access through misconfigured security controls. This article covers technical details, affected versions through 4.6.0, security impact, and recommended mitigation strategies.

CVE-2025-24589 Overview

CVE-2025-24589 is a Missing Authorization vulnerability [CWE-862] in the JS Morisset JSM Show Post Metadata WordPress plugin (jsm-show-post-meta). The flaw affects all versions up to and including 4.6.0. Authenticated attackers with low-level privileges can exploit incorrectly configured access control security levels to interact with plugin functionality that should be restricted. The vulnerability requires network access and low privileges, with no user interaction needed. It impacts confidentiality but does not affect integrity or availability of the WordPress installation.

Critical Impact
Low-privileged authenticated users can access plugin functionality intended for administrators, potentially exposing post metadata that should remain restricted.

Affected Products

JS Morisset JSM Show Post Metadata plugin for WordPress
All versions from initial release through 4.6.0
WordPress sites running the vulnerable jsm-show-post-meta plugin

Discovery Timeline

2025-01-24 - CVE-2025-24589 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-24589

Vulnerability Analysis

The JSM Show Post Metadata plugin exposes functionality that displays WordPress post metadata but fails to enforce proper authorization checks. The plugin does not verify whether the requesting user has the appropriate capability or role before returning metadata content. Authenticated users with minimal privileges, such as subscribers, can invoke restricted operations that should be limited to editors or administrators.

The vulnerability falls under Broken Access Control, a class of flaws where the application relies on the client-side context or insufficient server-side validation to enforce restrictions. In WordPress plugins, this pattern typically appears when AJAX handlers or REST endpoints omit current_user_can() checks or use overly permissive capability strings.

Root Cause

The root cause is a missing authorization check within the plugin's request handlers. The plugin registers callable actions that execute without validating the caller's role or capability against the sensitivity of the exposed data. This corresponds to CWE-862 (Missing Authorization).

Attack Vector

An attacker requires an authenticated account on the target WordPress site. After authenticating, the attacker sends crafted requests to the vulnerable plugin endpoint. Because the plugin does not validate authorization, the server returns post metadata to the attacker despite their insufficient privilege level. The attack is remotely exploitable over the network and requires no user interaction. Refer to the Patchstack Vulnerability Report for endpoint-level detail.

Detection Methods for CVE-2025-24589

Indicators of Compromise

Unexpected requests to jsm-show-post-meta plugin endpoints originating from low-privilege user sessions
WordPress access logs showing authenticated subscribers or contributors invoking metadata retrieval actions
Anomalous increases in AJAX or REST API calls tied to the vulnerable plugin

Detection Strategies

Audit WordPress user roles and capabilities to identify accounts making requests outside their normal scope
Compare plugin endpoint access patterns against expected role-based baselines
Enable WordPress activity logging to record capability checks and administrative actions

Monitoring Recommendations

Monitor web server logs for HTTP requests to /wp-admin/admin-ajax.php and REST routes associated with jsm-show-post-meta
Alert on authenticated requests returning HTTP 200 responses where the user role does not match the resource sensitivity
Track plugin version deployment across WordPress fleets to identify hosts still running 4.6.0 or earlier

How to Mitigate CVE-2025-24589

Immediate Actions Required

Identify all WordPress instances running the JSM Show Post Metadata plugin at version 4.6.0 or earlier
Restrict plugin usage to trusted authenticated users until a patched release is available
Review user accounts and revoke unnecessary privileges to limit the exploitable attacker pool

Patch Information

As of the referenced advisory, the vendor has not published a fixed release beyond 4.6.0. Administrators should monitor the Patchstack Vulnerability Report and the plugin repository for an updated version, and apply it promptly once released.

Workarounds

Deactivate and remove the jsm-show-post-meta plugin from WordPress sites where it is not essential
Deploy a web application firewall rule to block unauthenticated and low-privilege access to plugin endpoints
Enforce least-privilege role assignments and disable open user registration where feasible

bash

# Configuration example
wp plugin deactivate jsm-show-post-meta
wp plugin delete jsm-show-post-meta