CVE-2025-32252: WP Genealogy Auth Bypass Vulnerability

CVE-2025-32252 Overview

CVE-2025-32252 is a missing authorization vulnerability in the Black and White WP Genealogy – Your Family History Website (wpgenealogy) WordPress plugin. The flaw affects all versions up to and including 0.1.9. The plugin fails to enforce proper access control checks on protected functionality, allowing unauthenticated network attackers to interact with restricted operations. The issue is classified under CWE-862: Missing Authorization. Successful exploitation results in a limited integrity impact on affected WordPress sites running the plugin.

Critical Impact
Unauthenticated attackers can invoke plugin functionality that should require authorization, enabling unauthorized modifications to genealogy data on affected WordPress installations.

Affected Products

Black and White WP Genealogy – Your Family History Website plugin for WordPress
All versions from n/a through 0.1.9
WordPress sites with the wpgenealogy plugin installed and activated

Discovery Timeline

2025-04-04 - CVE CVE-2025-32252 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-32252

Vulnerability Analysis

The vulnerability stems from broken access control in the WP Genealogy plugin. The plugin exposes functionality that should be restricted to authorized users but does not validate the requester's permissions or capabilities before executing sensitive operations. This aligns with CWE-862: Missing Authorization, where the application performs actions without verifying that the actor holds the required privileges.

Because the attack is network-based and requires no authentication or user interaction, remote attackers can invoke the affected endpoints directly. The impact is limited to integrity, meaning attackers can modify or manipulate data exposed by the plugin, but cannot directly read confidential information or crash the site. The current EPSS probability is 0.498%, indicating low observed exploitation likelihood at this time.

Root Cause

The root cause is the absence of capability checks (such as current_user_can()) or nonce verification (wp_verify_nonce()) on plugin actions that alter state. WordPress plugins are expected to gate privileged AJAX handlers, admin-post callbacks, and REST endpoints behind capability and nonce checks. WP Genealogy versions through 0.1.9 omit these guards on at least one action, permitting anonymous callers to reach protected logic.

Attack Vector

An attacker sends a crafted HTTP request to the vulnerable endpoint exposed by the plugin on a WordPress site. Because no authentication is required, the request can be issued from any internet-connected host. The plugin processes the request as if it were from an authorized user and applies the requested change. Refer to the Patchstack advisory for scope details.

No verified public exploit code is available for CVE-2025-32252 at this time.

Detection Methods for CVE-2025-32252

Indicators of Compromise

Unexpected additions, edits, or deletions in WP Genealogy database tables or genealogy content on affected sites.
Anonymous HTTP POST or GET requests to wpgenealogy plugin endpoints, admin-ajax.php actions, or REST routes registered by the plugin.
WordPress audit logs showing state-changing plugin actions with no corresponding authenticated user session.

Detection Strategies

Inventory WordPress sites and identify installations running the WP Genealogy plugin at version 0.1.9 or earlier.
Deploy web application firewall rules to inspect requests targeting wpgenealogy action parameters and flag unauthenticated invocations.
Correlate web server access logs with WordPress authentication events to surface state-changing requests lacking valid sessions.

Monitoring Recommendations

Enable WordPress activity logging plugins to capture user context on genealogy content changes.
Alert on HTTP 200 responses to plugin endpoints when the source lacks a valid wordpress_logged_in_* cookie.
Monitor file integrity and database changes on WordPress hosts that expose the plugin publicly.

How to Mitigate CVE-2025-32252

Immediate Actions Required

Identify all WordPress sites running the WP Genealogy plugin and confirm the installed version.
Deactivate and remove the plugin if a patched release is not yet available and the functionality is not business-critical.
Restrict access to the WordPress site or the affected endpoints via network controls or authentication proxies until a fix is applied.

Patch Information

At the time of publication, the Patchstack advisory for the WP Genealogy plugin lists all versions through 0.1.9 as affected. Administrators should monitor the plugin's WordPress.org page and vendor advisories for a fixed release and upgrade immediately once available.

Workarounds

Uninstall the WP Genealogy plugin until the vendor publishes a patched version that enforces authorization.
Apply virtual patching at the web application firewall by blocking unauthenticated requests to wpgenealogy action handlers.
Restrict the WordPress admin and AJAX surfaces (/wp-admin/, /wp-admin/admin-ajax.php) to trusted IP ranges where feasible.

bash

# Example nginx rule to block anonymous access to the plugin's AJAX actions
location = /wp-admin/admin-ajax.php {
    if ($arg_action ~* "^wpgenealogy_") {
        # Require an authenticated session cookie
        if ($http_cookie !~* "wordpress_logged_in_") {
            return 403;
        }
    }
}