CVE-2025-30824 Overview
CVE-2025-30824 is a missing authorization vulnerability in the Israpil Textmetrics webtexttool WordPress plugin. The flaw stems from incorrectly configured access control security levels, allowing authenticated users with low privileges to reach functionality that should be restricted. The issue affects all versions of Textmetrics up to and including 3.6.1. The vulnerability is tracked under CWE-862: Missing Authorization and was documented in the Patchstack Vulnerability Report.
Critical Impact
Authenticated attackers with minimal privileges can bypass access control checks in the Textmetrics plugin, affecting integrity and availability of plugin-managed data.
Affected Products
- Israpil Textmetrics webtexttool plugin for WordPress
- All versions from initial release through 3.6.1
- WordPress sites with the Textmetrics plugin enabled
Discovery Timeline
- 2025-03-27 - CVE-2025-30824 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-30824
Vulnerability Analysis
The Textmetrics plugin exposes plugin actions without enforcing sufficient capability checks on the calling user. An authenticated user with a low-privilege role such as Subscriber can invoke plugin endpoints that should require Editor or Administrator capabilities. This mismatch between intended and enforced authorization allows unauthorized modification of plugin data or state.
The vulnerability affects the integrity and availability of resources managed by the plugin, but does not expose confidential data directly. Because it requires network access and authenticated credentials, exploitation typically occurs on multi-user WordPress deployments where account registration is enabled or attacker credentials are otherwise obtained.
Root Cause
The root cause is a missing or insufficient authorization check inside one or more plugin handlers. WordPress plugins are expected to guard privileged actions using current_user_can() capability checks combined with nonces from wp_verify_nonce(). In Textmetrics webtexttool versions through 3.6.1, at least one action path lacks a correct capability check, so the server processes the request as if the caller were properly authorized.
Attack Vector
Exploitation requires an attacker to authenticate to the target WordPress site with any valid account. The attacker then issues a crafted HTTP request to the vulnerable plugin endpoint, typically through admin-ajax.php or a REST route registered by the plugin. Because the vulnerable handler does not verify the caller's role or capability, the request executes with the effect of a privileged action. See the Patchstack advisory for further technical detail.
Detection Methods for CVE-2025-30824
Indicators of Compromise
- Requests to Textmetrics plugin endpoints originating from low-privilege user sessions such as Subscriber or Contributor accounts
- Unexpected changes to Textmetrics plugin settings, options, or content records without a corresponding administrator action
- New or recently registered WordPress accounts issuing requests to admin-ajax.php with Textmetrics-related action parameters
Detection Strategies
- Review WordPress access logs for POST requests to wp-admin/admin-ajax.php or Textmetrics REST endpoints from non-administrator users
- Correlate authenticated user role information with the plugin actions invoked to identify capability mismatches
- Audit the installed version of the webtexttool plugin across managed WordPress sites and flag any at 3.6.1 or earlier
Monitoring Recommendations
- Enable WordPress audit logging to capture plugin option updates and user role changes
- Forward web server and WordPress logs to a centralized analytics platform for role-versus-action correlation
- Alert on bursts of AJAX or REST requests from newly created accounts targeting plugin action names
How to Mitigate CVE-2025-30824
Immediate Actions Required
- Inventory all WordPress sites running the Textmetrics webtexttool plugin and identify installations at version 3.6.1 or earlier
- Update the plugin to a fixed release once the vendor publishes a patched version above 3.6.1
- Restrict new user registration on WordPress sites that do not require public account creation
- Review existing low-privilege accounts and remove any that are unused or unrecognized
Patch Information
At publication, the Patchstack advisory lists all versions through 3.6.1 as affected. Administrators should monitor the plugin's WordPress.org listing and the vendor advisory for a corrected release and apply it as soon as it becomes available.
Workarounds
- Deactivate and remove the Textmetrics plugin until a patched version is available if it is not business-critical
- Deploy a Web Application Firewall (WAF) rule to block requests to Textmetrics plugin actions from users lacking Editor or Administrator roles
- Limit access to wp-admin and admin-ajax.php to trusted IP ranges where operationally feasible
# Example: identify sites running vulnerable Textmetrics versions via WP-CLI
wp plugin get webtexttool --field=version
# Compare output against 3.6.1; deactivate if vulnerable
wp plugin deactivate webtexttool
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.