CVE-2025-24691 Overview
CVE-2025-24691 is a missing authorization vulnerability in the ctltwp People Lists WordPress plugin. The flaw affects all versions up to and including 1.3.10. Authenticated users with low privileges can exploit incorrectly configured access control security levels to perform actions beyond their intended permissions. The vulnerability is categorized under [CWE-862] Missing Authorization.
Critical Impact
Authenticated attackers with low-level privileges can bypass access control checks in the People Lists plugin, resulting in limited integrity impact on affected WordPress installations.
Affected Products
- ctltwp People Lists WordPress plugin versions through 1.3.10
- WordPress installations with the People Lists plugin active
- Any site permitting low-privileged authenticated user registration alongside this plugin
Discovery Timeline
- 2025-01-24 - CVE-2025-24691 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-24691
Vulnerability Analysis
The People Lists plugin exposes functionality that fails to verify whether the requesting user has appropriate authorization to invoke it. Attackers exploit this gap by sending requests to protected endpoints while authenticated at a lower privilege tier than the operation requires. The vulnerability is network-accessible and requires only low privileges, meaning any authenticated subscriber-level account on a vulnerable site can attempt exploitation. Successful exploitation yields limited integrity impact but does not expose confidential data or affect service availability directly.
Root Cause
The root cause is the absence of proper capability checks in one or more plugin endpoints. WordPress plugins must validate user permissions using functions such as current_user_can() and verify request authenticity with nonce validation via check_ajax_referer() or wp_verify_nonce(). When these checks are missing or incorrectly configured, the plugin trusts the authenticated session without confirming the user holds the required role or capability for the requested action.
Attack Vector
Exploitation requires an attacker to hold a valid authenticated account on the target WordPress site. The attacker crafts HTTP requests to plugin endpoints normally reserved for administrators or higher-privileged roles. Because the plugin does not verify the caller's capability, the server processes the request as if it were authorized. This pattern allows modification of plugin-managed data or execution of restricted actions from an account that should lack such permissions.
No verified public proof-of-concept code is available. Refer to the Patchstack Vulnerability Report for advisory details.
Detection Methods for CVE-2025-24691
Indicators of Compromise
- Unexpected changes to People Lists plugin data, including list entries, subscribers, or configuration settings modified by non-administrative accounts
- WordPress audit log entries showing low-privileged users invoking plugin actions that should require higher capabilities
- HTTP POST requests to admin-ajax.php or plugin REST endpoints originating from subscriber-level session cookies
Detection Strategies
- Review the WordPress wp_options and plugin-specific database tables for unauthorized modifications following plugin activity
- Correlate authenticated session identifiers with the roles of users invoking plugin management functions
- Enable verbose logging on the plugin's endpoints and flag requests where the acting user's role does not match the operation's required capability
Monitoring Recommendations
- Deploy a web application firewall rule that inspects requests to People Lists plugin endpoints and blocks calls from accounts lacking the required role
- Monitor WordPress user registration patterns for spikes that may indicate attackers creating accounts to exploit the flaw
- Alert on any administrative action performed by a user with a subscriber, contributor, or author role
How to Mitigate CVE-2025-24691
Immediate Actions Required
- Update the ctltwp People Lists plugin to a version released after 1.3.10 that addresses the missing authorization check
- If no patched version is available, deactivate and remove the plugin until a fix is published
- Audit existing user accounts and revoke any suspicious low-privileged accounts created recently
Patch Information
The vulnerability affects People Lists plugin versions through 1.3.10. Site administrators should consult the Patchstack Vulnerability Report for current patch availability and upgrade guidance. Apply vendor updates as soon as they become available.
Workarounds
- Restrict user registration on the affected WordPress site to reduce the pool of potential attackers
- Deploy a virtual patch through a web application firewall to block unauthorized access to People Lists plugin endpoints
- Limit access to wp-admin/admin-ajax.php for authenticated low-privileged users via server-level access controls where feasible
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.