CVE-2025-24600: RSVPMaker Auth Bypass Vulnerability

CVE-2025-24600 Overview

CVE-2025-24600 is a Missing Authorization vulnerability affecting the RSVPMarker plugin for WordPress developed by davidfcarr. The flaw impacts all plugin versions up to and including 11.4.5. Attackers can reach protected functionality over the network without authentication because the plugin fails to enforce authorization checks on sensitive actions. Successful exploitation allows limited modification of data within the affected WordPress site. The weakness is categorized under CWE-862 Missing Authorization and was published by Patchstack.

Critical Impact
Unauthenticated attackers can invoke plugin functions that should require authorization, leading to integrity impact on WordPress sites running RSVPMarker 11.4.5 or earlier.

Affected Products

davidfcarr RSVPMarker WordPress plugin
All versions from n/a through 11.4.5
WordPress sites with the vulnerable plugin installed and activated

Discovery Timeline

2025-01-27 - CVE-2025-24600 published to the National Vulnerability Database
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-24600

Vulnerability Analysis

The RSVPMarker plugin exposes one or more actions that do not verify the caller's permissions before executing. This category of flaw, tracked as CWE-862, occurs when server-side code trusts client requests without enforcing an access control decision. In WordPress plugins, missing authorization typically manifests as admin-ajax.php handlers, REST API endpoints, or admin-post hooks that omit current_user_can() checks or nonce validation. Attackers issue crafted HTTP requests directly to the endpoint and trigger privileged behavior.

The CVSS vector indicates network-based exploitation with no authentication and no user interaction required. Confidentiality and availability are not affected, but attackers can alter data reachable through the exposed handler. Refer to the Patchstack WordPress Vulnerability Report for the specific handler details.

Root Cause

The root cause is a missing capability or authorization check within the plugin's action handler. The vulnerable code path executes plugin logic without confirming that the requesting user is authorized to perform the operation. WordPress provides current_user_can() and nonce verification through check_ajax_referer() or wp_verify_nonce(), and the plugin does not consistently apply these controls before performing the action.

Attack Vector

An unauthenticated remote attacker sends a crafted HTTP request to the vulnerable RSVPMarker endpoint. The endpoint processes the request and performs the action without validating the requester's role or session. No user interaction is required, and the attacker can automate exploitation at scale against exposed WordPress sites.

No verified public exploit code is available. Descriptive analysis is based on the CWE-862 classification and the vendor advisory. See the Patchstack advisory for further technical detail.

Detection Methods for CVE-2025-24600

Indicators of Compromise

Unexpected modifications to RSVP events, guest lists, or plugin-managed content in the WordPress database
HTTP POST or GET requests to RSVPMarker AJAX or REST endpoints originating from unauthenticated sessions
Access log entries showing repeated requests to admin-ajax.php with RSVPMarker action parameters from external IP addresses
WordPress audit log entries showing plugin actions with no associated logged-in user

Detection Strategies

Inventory WordPress installations and identify sites running RSVPMarker version 11.4.5 or earlier
Deploy web application firewall rules that flag unauthenticated requests to RSVPMarker action endpoints
Monitor wp-content/plugins/rsvpmaker/ requests in web server access logs for anomalous request patterns
Compare current plugin data against known-good baselines to identify unauthorized changes

Monitoring Recommendations

Enable verbose HTTP access logging on WordPress front-ends and forward to a centralized log platform
Alert on high-frequency requests to plugin AJAX handlers from single source IPs
Track WordPress database changes to plugin tables using database audit tooling
Review Patchstack and WPScan feeds for updates to CVE-2025-24600 exploitation reporting

How to Mitigate CVE-2025-24600

Immediate Actions Required

Update the RSVPMarker plugin to a version released after 11.4.5 that addresses the missing authorization issue
If a fixed version is not yet available, deactivate and remove the RSVPMarker plugin until a patch is applied
Restrict access to /wp-admin/admin-ajax.php and REST API endpoints at the WAF or reverse proxy for external, unauthenticated callers where feasible
Audit WordPress content managed by RSVPMarker for unauthorized changes since January 27, 2025

Patch Information

Consult the Patchstack WordPress Vulnerability Report for the current fixed version and vendor guidance. Apply the update through the WordPress plugin manager or by replacing the plugin files with the patched release from the plugin repository.

Workarounds

Temporarily disable the RSVPMarker plugin on production sites until the update is deployed
Apply WAF rules to block unauthenticated access to RSVPMarker action names and REST routes
Enforce authentication in front of the WordPress admin surface using IP allowlists or HTTP basic authentication
Increase logging and review request patterns to detect exploitation attempts while remediation is in progress

bash

# Configuration example
# Disable the RSVPMarker plugin via WP-CLI until a patched version is installed
wp plugin deactivate rsvpmaker
wp plugin status rsvpmaker

# After a fixed release is available, update and re-enable
wp plugin update rsvpmaker
wp plugin activate rsvpmaker