CVE-2025-29010: Behance Portfolio Manager Auth Bypass Flaw

CVE-2025-29010 Overview

CVE-2025-29010 is a missing authorization vulnerability in the eleopard Behance Portfolio Manager WordPress plugin (portfolio-manager-powered-by-behance). The flaw affects all versions up to and including 1.7.5. It stems from incorrectly configured access control security levels [CWE-862], allowing authenticated users with low privileges to perform actions that should be restricted.

The issue is exploitable over the network with low attack complexity and requires only low-privileged authentication. Successful exploitation results in a limited integrity impact on the affected WordPress site. No confidentiality or availability impact is currently associated with this issue.

Critical Impact
Authenticated users with minimal privileges can invoke plugin functionality that should require elevated authorization, enabling unauthorized modification of portfolio data on affected WordPress sites.

Affected Products

eleopard Behance Portfolio Manager WordPress plugin (portfolio-manager-powered-by-behance)
All versions from initial release through 1.7.5
WordPress sites with the plugin installed and active

Discovery Timeline

2025-06-06 - CVE-2025-29010 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-29010

Vulnerability Analysis

The Behance Portfolio Manager plugin exposes plugin actions without enforcing proper capability or role checks. WordPress plugins typically gate sensitive actions with current_user_can() checks or nonce verification tied to a specific capability. This plugin omits or misconfigures those checks for one or more endpoints through version 1.7.5.

An authenticated attacker holding a low-privilege role such as Subscriber can send requests to the affected handler. The plugin processes the request as if the caller were authorized, permitting state changes that should be restricted to administrators. Impact is bounded to integrity because the vulnerable actions modify plugin-managed content rather than exposing data or disrupting service.

Root Cause

The root cause is a missing authorization check [CWE-862] on plugin action handlers. The code path executes privileged operations without validating that the authenticated user holds the required WordPress capability. This is a classic broken access control pattern in WordPress plugin development, where authentication is verified but authorization is not.

Attack Vector

Exploitation requires network access to the target WordPress site and valid authentication with a low-privilege account. Registration-open sites are particularly exposed because attackers can self-provision the required account. The attacker crafts an HTTP request to the vulnerable plugin endpoint. The server processes the request and applies the requested change without checking role or capability.

No verified public proof-of-concept exploit is available at the time of publication. The EPSS score indicates a low near-term probability of observed exploitation. Refer to the Patchstack Vulnerability Advisory for additional technical detail.

Detection Methods for CVE-2025-29010

Indicators of Compromise

Unexpected changes to Behance portfolio content, settings, or shortcode configurations on affected WordPress sites
HTTP POST or admin-ajax.php requests to Behance Portfolio Manager plugin actions originating from low-privilege user sessions
New Subscriber-level accounts created shortly before configuration changes to the plugin

Detection Strategies

Inventory WordPress installations and identify sites running portfolio-manager-powered-by-behance at version 1.7.5 or earlier
Review web server access logs for requests targeting plugin-specific action names or REST routes from non-administrator sessions
Correlate WordPress audit logs with plugin configuration changes to identify actions performed by unauthorized roles

Monitoring Recommendations

Enable a WordPress activity log plugin that records role-based action attempts and failed capability checks
Alert on portfolio content or plugin option modifications performed by users below the Editor role
Monitor for anomalous Subscriber-account creation followed by plugin API calls within a short time window

How to Mitigate CVE-2025-29010

Immediate Actions Required

Update Behance Portfolio Manager to a version above 1.7.5 once released by the vendor
Audit existing WordPress user accounts and disable or restrict any unnecessary low-privilege accounts
Disable open user registration on public WordPress sites where the plugin is installed until patched

Patch Information

As of the last NVD update on 2026-06-17, the advisory indicates the issue affects versions through 1.7.5. Administrators should consult the Patchstack Vulnerability Advisory for current fix availability and upgrade guidance from the plugin author.

Workarounds

Deactivate and remove the Behance Portfolio Manager plugin until a fixed version is available
Restrict access to /wp-admin/admin-ajax.php and plugin REST routes through a web application firewall rule scoped to authenticated administrators
Apply a virtual patch through a WordPress security plugin that enforces capability checks on the affected action handlers

bash

# Example: block requests to the plugin's AJAX actions from non-admin sessions using WAF pseudo-rule
# Replace <plugin_action_name> with the specific action identifier from the advisory
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,deny,status:403,id:1029010,msg:'Block Behance Portfolio Manager unauthorized action'"
  SecRule ARGS:action "@rx ^<plugin_action_name>$" \
    "chain"
    SecRule &SESSION:user_role "@eq 0"