CVE-2025-28938: WP Performance Pack Auth Bypass Vulnerability

CVE-2025-28938 Overview

CVE-2025-28938 is a missing authorization vulnerability in the Bjoern WP Performance Pack plugin for WordPress. The flaw affects all versions of wp-performance-pack up to and including 2.5.3. Authenticated users with low-level privileges can invoke plugin functionality that should be restricted to higher-privileged roles. The issue is tracked under CWE-862: Missing Authorization and stems from incorrectly configured access control checks. Patchstack disclosed the flaw through its vulnerability database.

Critical Impact
Authenticated attackers with minimal privileges can exploit broken access control in wp-performance-pack to trigger restricted plugin actions, potentially degrading site availability.

Affected Products

Bjoern WP Performance Pack plugin for WordPress
All versions from initial release through 2.5.3
WordPress sites with the plugin activated and low-privileged user registration enabled

Discovery Timeline

2025-03-11 - CVE-2025-28938 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-28938

Vulnerability Analysis

The vulnerability resides in the wp-performance-pack plugin's handling of privileged operations. The plugin exposes action handlers without verifying that the calling user holds the required WordPress capability. An authenticated attacker with a low-privilege role such as Subscriber can invoke these handlers by issuing crafted requests to the plugin's endpoints.

Because the vulnerability requires only network access and low privileges, exploitation is straightforward on any WordPress instance that permits user registration. The impact is limited to availability, meaning attackers cannot directly read or modify sensitive data through this flaw alone. Confidentiality and integrity are not affected according to the published CVSS vector.

Root Cause

The root cause is a missing capability check within the plugin's request handlers. WordPress plugins are expected to enforce authorization using current_user_can() and to validate nonces via check_admin_referer() or wp_verify_nonce(). The wp-performance-pack code paths reachable through this vulnerability omit or misconfigure these checks. This gap allows any authenticated session to reach code intended for administrators.

Attack Vector

Exploitation requires an authenticated WordPress account on the target site. The attacker sends an HTTP request to the vulnerable plugin endpoint, supplying parameters that trigger the restricted action. No user interaction is required beyond the attacker's own request. Sites that allow open registration or that host multiple low-privilege editors face the greatest exposure. For technical specifics, refer to the Patchstack vulnerability report.

Detection Methods for CVE-2025-28938

Indicators of Compromise

Unexpected admin-ajax.php or plugin endpoint requests originating from Subscriber-level accounts targeting wp-performance-pack actions.
Cache regeneration, configuration changes, or performance-related plugin activity not associated with an administrator session.
Anomalous spikes in authenticated POST requests from accounts that normally read content only.

Detection Strategies

Review WordPress access logs for requests to plugin action handlers correlated with non-administrator user IDs.
Enable a WordPress activity logging plugin to record capability-sensitive actions and identify unauthorized invocations.
Deploy a web application firewall (WAF) rule that blocks requests to wp-performance-pack endpoints from sessions lacking administrator cookies.

Monitoring Recommendations

Alert on new low-privileged account registrations followed by requests to plugin administrative endpoints within a short window.
Baseline normal request patterns to plugin endpoints and flag deviations for review.
Forward WordPress and web server logs to a centralized analytics platform for cross-account correlation.

How to Mitigate CVE-2025-28938

Immediate Actions Required

Update wp-performance-pack to a version later than 2.5.3 once released by the maintainer.
Audit existing WordPress accounts and remove or downgrade unnecessary low-privilege accounts.
Disable open user registration if it is not required for site operation.

Patch Information

At the time of NVD publication, versions through 2.5.3 remain vulnerable. Administrators should monitor the Patchstack advisory and the plugin's WordPress.org page for a fixed release. If no patch is available, deactivate the plugin until one is published.

Workarounds

Deactivate and remove the wp-performance-pack plugin until a patched version is available.
Restrict access to wp-admin/admin-ajax.php and plugin endpoints via WAF rules that require administrator authentication.
Enforce strong role separation and remove the plugin from sites that permit self-service registration.

bash

# Deactivate the vulnerable plugin using WP-CLI
wp plugin deactivate wp-performance-pack

# Optional: remove the plugin entirely until a fix is released
wp plugin uninstall wp-performance-pack

# Disable open registration site-wide
wp option update users_can_register 0