CVE-2025-3949 Overview
CVE-2025-3949 is a missing authorization vulnerability in the Website Builder by SeedProd plugin for WordPress. The flaw affects the seedprod_lite_get_revisisons function in all versions up to and including 6.18.15. The function lacks a capability check, allowing authenticated attackers with Subscriber-level access or higher to read arbitrary landing page revisions. The vulnerability is classified under [CWE-862] Missing Authorization.
Critical Impact
Authenticated users with minimal privileges can read the content of arbitrary landing page revisions, exposing draft marketing content, unpublished pages, and any sensitive data stored within revision history.
Affected Products
- Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode plugin for WordPress
- All versions up to and including 6.18.15
- WordPress sites with Subscriber-level or higher user registration enabled
Discovery Timeline
- 2025-05-09 - CVE-2025-3949 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-3949
Vulnerability Analysis
The vulnerability resides in the seedprod_lite_get_revisisons function located in app/lpage.php of the SeedProd plugin. The function is registered as an AJAX handler accessible to authenticated WordPress users. It retrieves landing page revision data based on a supplied identifier but does not verify whether the requesting user has the appropriate capability to view the requested content.
WordPress role-based access control expects sensitive content endpoints to enforce capability checks such as current_user_can('edit_posts') or a similar permission gate. The affected function omits this validation. Any authenticated session, including default Subscriber accounts created through open WordPress registration, can invoke the endpoint and receive revision data belonging to other users.
Root Cause
The root cause is a missing capability check inside the AJAX callback. The function trusts request parameters and returns landing page revision content without validating the caller's role or ownership of the target page. This is a classic broken access control pattern where authentication is confirmed but authorization is not enforced.
Attack Vector
Exploitation requires network access to the WordPress site and an authenticated account with Subscriber privileges or higher. The attacker sends a crafted AJAX request to the vulnerable endpoint, supplying a revision identifier. The server responds with the revision content regardless of the attacker's role. On sites permitting open registration, an unauthenticated attacker can first register an account and then exploit the flaw. The vulnerability exposes confidentiality only; integrity and availability are not affected.
Refer to the WordPress Plugin Code Reference and the Wordfence Vulnerability Report for technical details.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2025-3949
Indicators of Compromise
- AJAX POST requests to admin-ajax.php invoking the seedprod_lite_get_revisisons action from accounts with Subscriber-level roles
- Unexpected creation of new Subscriber accounts followed by requests to SeedProd endpoints
- Access log entries showing repeated calls to the revisions endpoint with incrementing revision identifiers
Detection Strategies
- Review WordPress access logs for authenticated requests to admin-ajax.php referencing the seedprod_lite_get_revisisons action
- Correlate low-privilege user session activity with sensitive plugin AJAX endpoints
- Alert on account enumeration patterns targeting landing page revision identifiers
Monitoring Recommendations
- Enable verbose logging on the WordPress site and forward web server logs to a centralized analytics platform
- Monitor for spikes in AJAX request volume from newly registered Subscriber accounts
- Track modifications to WordPress user roles and unexpected privilege changes
How to Mitigate CVE-2025-3949
Immediate Actions Required
- Update the Website Builder by SeedProd plugin to a version later than 6.18.15 that contains the capability check fix
- Audit existing WordPress user accounts and remove unnecessary Subscriber-level accounts
- Disable open user registration if it is not required for site functionality
Patch Information
The vendor addressed the issue in a release following 6.18.15. Review the WordPress Plugin Changeset and the SeedProd Changelog to confirm the fixed version and validate deployment.
Workarounds
- Disable the SeedProd plugin until the patched version can be deployed
- Restrict access to admin-ajax.php from untrusted networks using a web application firewall rule
- Enforce strong registration controls and require administrator approval for new accounts
# Update the SeedProd plugin via WP-CLI to the latest fixed version
wp plugin update coming-soon
# Verify the installed version is greater than 6.18.15
wp plugin get coming-soon --field=version
# Optionally disable open registration until patching is confirmed
wp option update users_can_register 0
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
