CVE-2025-28874 Overview
CVE-2025-28874 is an authorization bypass vulnerability in the BP Email Assign Templates WordPress plugin developed by shanebp. The flaw stems from an Insecure Direct Object Reference (IDOR) pattern classified under [CWE-639], where the application relies on user-controlled keys to make access-control decisions. An authenticated attacker with elevated privileges can abuse this weakness to delete arbitrary content within the affected site. The vulnerability affects all plugin versions up to and including 1.7. Site operators running BuddyPress deployments that use this plugin for email template management should treat it as a data-integrity risk against WordPress content.
Critical Impact
Authenticated attackers can trigger arbitrary content deletion on WordPress sites running vulnerable versions of the BP Email Assign Templates plugin.
Affected Products
- shanebp BP Email Assign Templates plugin for WordPress
- All versions from n/a through 1.7
- WordPress sites using BuddyPress with this plugin installed
Discovery Timeline
- 2025-03-11 - CVE-2025-28874 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-28874
Vulnerability Analysis
The vulnerability is an Authorization Bypass Through User-Controlled Key issue, tracked under [CWE-639]. The plugin exposes functionality that acts on objects identified by parameters supplied in the request, but it does not verify that the requesting user is authorized to act on the referenced object. As a result, a user who legitimately holds high privileges within the plugin's scope can supply identifiers pointing to content they should not control, and the plugin will process the operation. According to the Patchstack advisory, the concrete impact is arbitrary content deletion within the WordPress instance.
Root Cause
The root cause is incorrectly configured access control at the object level. The plugin trusts identifiers submitted by the client to select the target of a state-changing operation without cross-checking ownership or role-based permission for that specific object. This is a classic IDOR pattern in which authentication is enforced but per-object authorization is missing.
Attack Vector
Exploitation requires network access to the WordPress site and a valid authenticated session with high privileges within the application. No user interaction is required. The attacker submits a crafted request containing an object identifier for content they do not own, and the plugin performs the deletion on the attacker's behalf. See the Patchstack WP Plugin Vulnerability advisory for further technical context. No public proof-of-concept exploit is currently listed.
Detection Methods for CVE-2025-28874
Indicators of Compromise
- Unexpected deletion of WordPress posts, pages, or email templates without a corresponding admin action in audit logs.
- Requests to plugin endpoints under wp-admin referencing object identifiers that do not belong to the requesting user.
- Spikes in POST requests to BP Email Assign Templates administrative handlers from a single authenticated session.
Detection Strategies
- Review WordPress audit logs for content deletion events initiated by non-administrator accounts that hold plugin-level privileges.
- Correlate HTTP request logs with the WordPress user session ID to identify object identifier manipulation across user boundaries.
- Alert on repeated deletion calls to the plugin within short time windows, which may indicate enumeration of object identifiers.
Monitoring Recommendations
- Deploy a WordPress activity logging plugin to capture content modification and deletion events with full user attribution.
- Forward web server and WordPress logs to a centralized log platform for retention and query.
- Monitor for privileged plugin actions performed outside expected administrative hours.
How to Mitigate CVE-2025-28874
Immediate Actions Required
- Inventory WordPress instances to identify sites running bp-email-assign-templates version 1.7 or earlier.
- Restrict access to WordPress administrative roles and remove unnecessary privileged accounts that could reach the vulnerable functionality.
- Back up WordPress content and databases so that any deletion caused by exploitation can be restored quickly.
Patch Information
At the time of publication, no fixed version is listed in the NVD entry; the advisory identifies all versions through 1.7 as affected. Administrators should monitor the Patchstack advisory and the plugin's official WordPress.org page for a patched release, and apply it as soon as one becomes available.
Workarounds
- Deactivate and remove the BP Email Assign Templates plugin until a patched version is released.
- Apply a virtual patch through a Web Application Firewall (WAF) to block requests that manipulate object identifiers in plugin endpoints.
- Reduce the number of accounts holding privileges required to reach the vulnerable functionality to shrink the exploitation surface.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
