CVE-2025-31887 Overview
CVE-2025-31887 is a missing authorization vulnerability in the MyBookProgress by Stormhill Media WordPress plugin developed by zookatron. The flaw affects all versions up to and including 1.0.8. The plugin fails to enforce correct access control checks on protected functionality, allowing authenticated users with low privileges to perform actions reserved for higher-privileged roles. The weakness maps to CWE-862: Missing Authorization.
Critical Impact
Authenticated attackers with minimal privileges can invoke plugin actions without proper authorization, resulting in limited integrity impact on WordPress sites running MyBookProgress <= 1.0.8.
Affected Products
- MyBookProgress by Stormhill Media WordPress plugin, versions n/a through 1.0.8
- WordPress sites with the mybookprogress plugin installed and activated
- Any WordPress deployment allowing user registration where the plugin is present
Discovery Timeline
- 2025-04-01 - CVE-2025-31887 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-31887
Vulnerability Analysis
The vulnerability stems from broken access control in the MyBookProgress plugin. The plugin exposes functionality that should verify a caller's role or capability before executing sensitive operations. Instead, the code paths omit or incorrectly configure the capability check, letting authenticated low-privilege users trigger actions outside their intended permission scope.
The attack requires network access and low privileges, meaning the attacker must hold at least a subscriber-level authenticated session. No user interaction is needed. Successful exploitation results in a limited integrity impact, with no direct confidentiality or availability effect based on the published vector.
The Exploit Prediction Scoring System (EPSS) currently rates the likelihood of exploitation activity at a low percentile, and no public proof-of-concept exploit has been observed at the time of writing.
Root Cause
The root cause is a missing or incorrectly configured authorization check on one or more plugin endpoints, aligning with CWE-862. WordPress plugins typically enforce authorization using current_user_can() and nonce validation via check_ajax_referer(). When these checks are absent or misapplied, any logged-in user can reach protected handlers.
Attack Vector
An attacker registers or authenticates as a low-privilege WordPress user, such as a subscriber. The attacker then sends a crafted HTTP request to the vulnerable plugin endpoint, such as an admin-ajax action or a REST route registered by MyBookProgress. Because the plugin does not verify the user's role, the server processes the request and applies changes the caller was not authorized to make. Technical specifics are documented in the Patchstack Vulnerability Report.
Detection Methods for CVE-2025-31887
Indicators of Compromise
- Unexpected modifications to book progress records or plugin-managed content associated with low-privilege user accounts.
- HTTP POST requests to wp-admin/admin-ajax.php or plugin REST endpoints originating from subscriber-level accounts.
- Access log entries showing repeated requests to mybookprogress-related actions from a single low-privilege session.
Detection Strategies
- Audit WordPress access logs for requests to plugin endpoints containing mybookprogress action names sent by non-editor, non-administrator accounts.
- Compare the plugin version reported in wp-content/plugins/mybookprogress/ against the fixed version once released by the vendor.
- Correlate user role data with recent plugin data changes to identify actions performed outside the actor's permission scope.
Monitoring Recommendations
- Enable WordPress activity logging to capture user role, IP address, and action for every plugin request.
- Alert on newly registered subscriber accounts that immediately interact with plugin administrative actions.
- Forward WordPress and web server logs into a centralized analytics platform to correlate authorization anomalies across the site.
How to Mitigate CVE-2025-31887
Immediate Actions Required
- Inventory all WordPress sites and identify installations running mybookprogress version 1.0.8 or earlier.
- Deactivate and remove the MyBookProgress plugin on affected sites until a patched version is available.
- Restrict new user registration on public WordPress sites where the plugin remains active.
- Review recent plugin-related changes for signs of unauthorized modification and roll back suspicious entries.
Patch Information
At the time of publication, the vendor advisory tracked by Patchstack indicates the vulnerability affects MyBookProgress up to and including version 1.0.8. Administrators should monitor the Patchstack Vulnerability Report and the plugin's WordPress.org listing for a fixed release, then upgrade immediately when available.
Workarounds
- Deploy a Web Application Firewall (WAF) rule to block requests to mybookprogress plugin actions from users lacking editor or administrator roles.
- Disable public user registration under Settings > General in WordPress to prevent attackers from obtaining the low-privilege session required for exploitation.
- Apply the principle of least privilege by auditing existing user accounts and demoting or removing accounts that do not require access.
# Configuration example: disable open registration and remove the vulnerable plugin
wp option update users_can_register 0
wp plugin deactivate mybookprogress
wp plugin delete mybookprogress
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
