CVE-2025-2815 Overview
CVE-2025-2815 affects the Administrator Z plugin for WordPress in all versions up to and including 2025.03.24. The vulnerability stems from a missing capability check on the adminz_import_backup() function. Authenticated attackers with Subscriber-level access or higher can update arbitrary WordPress options. Attackers can leverage this flaw to enable user registration and set the default role to administrator, granting themselves full administrative control over the site. The issue is tracked under [CWE-862: Missing Authorization]. CVE-2025-26959 is a duplicate of this issue.
Critical Impact
A Subscriber-level account can escalate to full administrator on any vulnerable WordPress site running Administrator Z, leading to complete site takeover.
Affected Products
- WordPress Administrator Z plugin, all versions through 2025.03.24
- WordPress sites permitting Subscriber-or-higher account registration with the plugin installed
- Any deployment of the Administrator Z plugin where the vulnerable adminz_import_backup() handler is reachable
Discovery Timeline
- 2025-03-28 - CVE-2025-2815 published to NVD
- 2026-04-15 - Last updated in NVD database
Technical Details for CVE-2025-2815
Vulnerability Analysis
The Administrator Z plugin exposes an adminz_import_backup() function intended for restoring backups. The handler does not verify whether the requesting user holds an administrative capability such as manage_options. As a result, any authenticated user can invoke the function and overwrite arbitrary entries in the wp_options table. WordPress stores critical site behavior in options, including users_can_register and default_role. By flipping these two values, an attacker converts the public registration form into an administrator-creation endpoint. The flaw maps to [CWE-862] and falls under the broader category of Broken Access Control and Privilege Escalation.
Root Cause
The root cause is a missing authorization check inside the import handler. The function neither calls current_user_can() with an administrative capability nor validates a properly scoped nonce that would bind the action to an administrator session. Any logged-in user reaches the privileged code path.
Attack Vector
The attack vector is network-based and requires only low-privilege authentication. An attacker first registers or compromises a Subscriber account. The attacker then sends a crafted request to the plugin's import endpoint containing serialized option data. The request sets users_can_register to 1 and default_role to administrator. The attacker registers a new account through the standard WordPress signup form, and that account is created with administrator privileges.
No verified public exploit code is published. See the Wordfence Vulnerability Report and the WordPress Changeset Update for technical details on the fix.
Detection Methods for CVE-2025-2815
Indicators of Compromise
- Unexpected changes to the users_can_register or default_role values in wp_options.
- Newly created administrator accounts that did not originate from a known admin workflow.
- HTTP POST requests to plugin endpoints referencing adminz_import_backup from low-privilege sessions.
- Audit log entries showing option updates initiated by Subscriber-level user IDs.
Detection Strategies
- Inspect WordPress access logs for authenticated POST requests to admin-ajax.php or admin-post.php referencing the Administrator Z plugin handlers.
- Compare current values of users_can_register and default_role against a known-good baseline.
- Enumerate accounts in wp_users with the administrator role and reconcile against an approved admin list.
Monitoring Recommendations
- Forward WordPress and web server logs to a centralized SIEM for correlation across plugin endpoints and user role changes.
- Alert on any modification of security-relevant options such as default_role, users_can_register, siteurl, and home.
- Track new user registrations and trigger alerts when an account is created with the administrator role outside of a maintenance window.
How to Mitigate CVE-2025-2815
Immediate Actions Required
- Update the Administrator Z plugin to a version released after 2025.03.24 that includes the capability check fix.
- If no patched version is available, deactivate and remove the plugin until a fixed release is published.
- Audit wp_users for unauthorized administrator accounts and revoke any that are not approved.
- Reset credentials for all administrator accounts and rotate WordPress secret keys in wp-config.php.
Patch Information
The vendor remediated the issue by adding a capability check to the adminz_import_backup() function. Review the upstream change in the WordPress Changeset Update and confirm the installed plugin version is newer than 2025.03.24.
Workarounds
- Disable open user registration by unchecking "Anyone can register" in WordPress general settings until the plugin is patched.
- Restrict access to /wp-admin/admin-ajax.php and /wp-admin/admin-post.php plugin handlers via a web application firewall rule that blocks low-privilege calls to adminz_import_backup.
- Enforce the principle of least privilege by removing unnecessary Subscriber-level accounts and requiring strong authentication on remaining low-privilege users.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
