CVE-2025-30591: Music Press Pro Auth Bypass Vulnerability

CVE-2025-30591 Overview

CVE-2025-30591 is a missing authorization vulnerability [CWE-862] in the tuyennv Music Press Pro WordPress plugin. The flaw affects all versions of music-press-pro up to and including 1.4.6. Attackers exploit incorrectly configured access control security levels to reach functionality that should require authentication or higher privileges.

The vulnerability is exploitable over the network without user interaction or prior authentication. It carries a CVSS 3.1 base score of 5.3, reflecting a low impact to confidentiality with no impact to integrity or availability. The EPSS score is 0.346% at the 26.9 percentile as of July 2026.

Critical Impact
Unauthenticated attackers can access plugin functionality restricted by broken access control, potentially exposing limited data from affected WordPress sites.

Affected Products

tuyennv Music Press Pro plugin for WordPress
Music Press Pro versions from n/a through 1.4.6
WordPress sites running the vulnerable music-press-pro plugin

Discovery Timeline

2025-03-24 - CVE-2025-30591 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30591

Vulnerability Analysis

The vulnerability stems from a broken access control implementation in Music Press Pro. The plugin exposes one or more endpoints or actions without verifying that the requesting user holds the required capability or role. This condition is classified under [CWE-862] Missing Authorization.

Attackers send crafted HTTP requests directly to the vulnerable plugin endpoint. The plugin processes those requests without performing the necessary capability check, granting the attacker access to functionality intended for authorized users. Confidentiality is affected at a low level, while integrity and availability remain intact according to the published CVSS vector.

The attack surface is limited to sites running Music Press Pro 1.4.6 or earlier. The Patchstack advisory categorizes the issue as a broken access control vulnerability affecting plugin actions exposed through the WordPress request lifecycle.

Root Cause

The root cause is the absence of current_user_can() capability checks or equivalent authorization logic on plugin handlers. WordPress plugins must validate the requester's capability before executing privileged actions. Music Press Pro fails to enforce this control on the affected code paths through version 1.4.6.

Attack Vector

Remote attackers target the plugin over the network without authentication or user interaction. Exploitation requires only the ability to send HTTP requests to the vulnerable WordPress site. See the Patchstack Vulnerability Report for technical details on the affected endpoints.

Detection Methods for CVE-2025-30591

Indicators of Compromise

Unauthenticated HTTP requests targeting Music Press Pro plugin endpoints under /wp-admin/admin-ajax.php or /wp-content/plugins/music-press-pro/
Access log entries showing successful 200 responses to plugin actions from unauthenticated sources
Unusual data retrieval patterns from music-press-pro handlers outside normal user sessions

Detection Strategies

Inventory WordPress installations and identify sites running music-press-pro at version 1.4.6 or earlier
Monitor web server access logs for requests to plugin-specific action names originating from sessions lacking valid WordPress authentication cookies
Deploy web application firewall rules that alert on plugin endpoints accessed without valid nonce or capability context

Monitoring Recommendations

Enable verbose logging for the WordPress REST API and admin-ajax.php handlers used by the plugin
Alert on anomalous request volume or geographic distribution targeting Music Press Pro endpoints
Correlate plugin access events with WordPress authentication events to identify unauthenticated exploitation attempts

How to Mitigate CVE-2025-30591

Immediate Actions Required

Identify all WordPress sites running Music Press Pro and confirm the installed version
Update music-press-pro to a version later than 1.4.6 once the vendor releases a fix
Restrict access to WordPress admin and plugin endpoints via network controls where feasible
Review WordPress user roles and audit for unauthorized account creation or content changes

Patch Information

Refer to the Patchstack Vulnerability Report for current patch status and vendor guidance. If no fixed version is available, treat this as an unpatched vulnerability and apply compensating controls.

Workarounds

Deactivate and remove the Music Press Pro plugin until a patched release is available
Deploy a WordPress-aware web application firewall to block requests to the vulnerable plugin endpoints
Apply IP allowlisting on /wp-admin/ and plugin action URLs to limit exposure to trusted networks

bash

# Configuration example: block unauthenticated access to Music Press Pro endpoints
# nginx snippet
location ~* /wp-content/plugins/music-press-pro/ {
    deny all;
    return 403;
}