CVE-2025-30960: FS Poster Auth Bypass Vulnerability

CVE-2025-30960 Overview

CVE-2025-30960 is a Missing Authorization vulnerability in the FS Poster plugin for WordPress, developed by fs-code. The flaw affects all versions of FS Poster up to and including 6.5.8. Authenticated users with low privileges, such as the Subscriber role, can invoke privileged plugin actions because access control checks are absent. The vulnerability is categorized under [CWE-862] Missing Authorization and is exploitable over the network with low attack complexity. Patchstack tracks the issue as a site-wide broken access control flaw.

Critical Impact
Authenticated Subscriber-level attackers can perform privileged plugin actions, leading to high-impact integrity and availability compromise of WordPress sites running FS Poster <= 6.5.8.

Affected Products

fs-code FS Poster WordPress plugin (fs-poster)
All versions from initial release through 6.5.8
WordPress sites that allow user registration at the Subscriber role or higher

Discovery Timeline

2025-04-16 - CVE-2025-30960 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30960

Vulnerability Analysis

FS Poster exposes plugin functionality through WordPress AJAX or REST endpoints without verifying that the requesting user holds the required capability. The plugin checks that a user is logged in but does not enforce role or capability boundaries on sensitive actions. As a result, any authenticated account, including Subscriber accounts created through open registration, can reach administrative functionality.

Exploitation produces low confidentiality impact but high integrity and availability impact. Attackers can alter plugin configuration, trigger outbound posting actions, or change scheduled content distribution across the site. The Exploit Prediction Scoring System (EPSS) currently reports a probability of 0.256% for in-the-wild exploitation, with no public proof-of-concept code listed at the time of writing.

Root Cause

The root cause is a missing current_user_can() capability check, or an equivalent authorization gate, on one or more plugin handlers. The plugin relies on authentication alone to gate privileged actions. WordPress treats any registered account as authenticated, so Subscriber-level users satisfy this insufficient check and reach code paths intended for administrators.

Attack Vector

An attacker first obtains a low-privileged account on a vulnerable WordPress site. On sites with open registration, this step requires no social engineering. The attacker then sends a crafted HTTP request to the FS Poster endpoint with a valid nonce or session cookie. The plugin processes the request as if it originated from a privileged user. Because the action runs server-side under the site context, the attacker can modify configured social accounts, publish to connected platforms, or disrupt scheduled jobs. Refer to the Patchstack Vulnerability Report for technical details.

Detection Methods for CVE-2025-30960

Indicators of Compromise

Unexpected requests to FS Poster AJAX actions or REST routes originating from accounts with the Subscriber role.
Changes to FS Poster configuration, connected social accounts, or scheduled posts that do not map to administrator activity.
New or modified options in the wp_options table associated with the fs-poster plugin without a corresponding admin login event.

Detection Strategies

Audit WordPress access logs for POST requests to admin-ajax.php or plugin-specific REST endpoints containing fs-poster or fs_poster parameters from non-administrative users.
Correlate plugin configuration changes with the authoring user role, flagging any change initiated by a non-Editor, non-Administrator account.
Deploy WordPress activity logging plugins to capture capability checks and option changes for post-incident review.

Monitoring Recommendations

Alert on registration spikes followed by requests to plugin administrative endpoints within a short interval.
Monitor outbound API calls from the WordPress host to social media platforms for content the marketing team did not schedule.
Track the installed version of FS Poster across all managed sites and flag any instance at or below 6.5.8.

How to Mitigate CVE-2025-30960

Immediate Actions Required

Update FS Poster to a version later than 6.5.8 as soon as the vendor releases a patched build.
Disable open user registration, or restrict the default new-user role to a value below Subscriber if registration is required.
Review existing low-privileged accounts and remove any that cannot be tied to a legitimate user.

Patch Information

No fixed version is listed in the NVD record at the time of publication. Site operators should consult the Patchstack Vulnerability Report and the plugin changelog on WordPress.org for the patched release covering CVE-2025-30960.

Workarounds

Deactivate the FS Poster plugin until a patched version is installed if Subscriber-level accounts exist on the site.
Use a Web Application Firewall (WAF) rule to block requests to FS Poster AJAX and REST endpoints from sessions whose user role is below Editor.
Revoke and rotate API tokens for any social platforms connected through FS Poster to limit downstream abuse if exploitation is suspected.

bash

# Configuration example: enforce minimum role for registration in wp-config.php
define( 'WP_DEFAULT_THEME', 'twentytwentyfour' );
update_option( 'users_can_register', 0 );
update_option( 'default_role', 'subscriber' );