CVE-2025-30605: sourceplay-navermap Auth Bypass Vulnerability

CVE-2025-30605 Overview

CVE-2025-30605 is a missing authorization vulnerability [CWE-862] in the ldwin79 sourceplay-navermap WordPress plugin. The flaw affects all versions up to and including 0.0.2. Authenticated attackers with low privileges can exploit incorrectly configured access control security levels to reach functionality that should be restricted. The vulnerability is network-exploitable and requires no user interaction, but its impact is limited to integrity of plugin data.

Critical Impact
Authenticated users with low privilege levels can invoke plugin actions that lack proper capability checks, allowing unauthorized modification of plugin state within affected WordPress sites.

Affected Products

ldwin79 sourceplay-navermap WordPress plugin
All versions from n/a through <= 0.0.2
WordPress sites with the plugin installed and active

Discovery Timeline

2025-03-24 - CVE-2025-30605 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30605

Vulnerability Analysis

The sourceplay-navermap plugin exposes one or more actions that fail to validate whether the requesting user has the required capability. WordPress plugins typically enforce authorization through current_user_can() checks combined with nonce verification. When these guards are missing or misconfigured, low-privileged authenticated users can invoke administrator-intended endpoints. The vulnerability is limited to integrity impact, meaning attackers can alter plugin data but cannot directly disclose sensitive information or trigger denial of service.

Root Cause

The root cause is a missing authorization check [CWE-862] on plugin endpoints. The plugin registers handlers, most likely as admin-ajax.php actions or REST routes, without verifying the caller's role. As a result, any authenticated session, including subscriber-level accounts, satisfies the access precondition.

Attack Vector

Exploitation requires network access and a valid authenticated session with low privileges. An attacker logs into the WordPress site and issues a crafted HTTP request to the vulnerable plugin endpoint. Because the endpoint does not verify capability, the request executes with the plugin's intended effect. See the Patchstack Vulnerability Report for additional technical detail.

// No verified proof-of-concept code is publicly available for this CVE.
// Refer to the Patchstack advisory for technical specifics.

Detection Methods for CVE-2025-30605

Indicators of Compromise

Unexpected modifications to sourceplay-navermap plugin settings or map configuration data
HTTP POST requests to admin-ajax.php or plugin REST routes originating from low-privileged user sessions
WordPress audit log entries showing subscriber or contributor accounts invoking plugin administrative actions

Detection Strategies

Inventory WordPress installations to identify sites running sourceplay-navermap version <= 0.0.2
Review web server access logs for requests to plugin endpoints correlated with non-administrator authentication cookies
Deploy a WordPress security plugin that logs capability check failures and unauthorized action attempts

Monitoring Recommendations

Monitor changes to plugin-owned database options and post meta associated with sourceplay-navermap
Alert on newly registered low-privilege accounts that immediately interact with plugin AJAX or REST endpoints
Track outbound HTTP traffic from the WordPress host for anomalies that could indicate follow-on activity

How to Mitigate CVE-2025-30605

Immediate Actions Required

Deactivate and remove the sourceplay-navermap plugin if no vendor-patched version is available
Audit existing user accounts and remove unused subscriber, contributor, or author accounts that could be leveraged for exploitation
Restrict WordPress registration and enforce strong authentication to reduce the pool of low-privileged accounts

Patch Information

No fixed version is listed in the advisory. Affected versions include everything through 0.0.2. Site owners should consult the Patchstack Vulnerability Report for updates and remove the plugin until a patched release is confirmed.

Workarounds

Block access to the plugin's AJAX actions and REST routes at the web application firewall for non-administrator sessions
Disable open user registration under Settings > General to limit account creation
Apply virtual patching rules that enforce capability checks on requests targeting the plugin's endpoints

bash

# Disable the plugin via WP-CLI until a patched version is released
wp plugin deactivate sourceplay-navermap
wp plugin delete sourceplay-navermap