CVE-2025-49986: Video List Manager Auth Bypass Flaw

CVE-2025-49986 Overview

CVE-2025-49986 is a Missing Authorization vulnerability [CWE-862] in the thanhtungtnt Video List Manager plugin for WordPress. The flaw affects all versions up to and including 1.7. Attackers can reach plugin functionality that is not properly constrained by Access Control Lists (ACLs), enabling unauthenticated interaction with restricted actions over the network.

The issue stems from broken access control, allowing requests without valid authorization checks to invoke plugin operations. Exploitation requires no privileges and no user interaction, and the attack vector is network-based. Successful abuse produces limited integrity impact against the affected WordPress site.

Critical Impact
Unauthenticated attackers can invoke restricted Video List Manager functionality on WordPress sites running version 1.7 or earlier, resulting in limited integrity impact.

Affected Products

thanhtungtnt Video List Manager WordPress plugin (video-list-manager)
All versions from n/a through 1.7
WordPress sites with the plugin installed and activated

Discovery Timeline

2025-06-20 - CVE-2025-49986 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-49986

Vulnerability Analysis

The Video List Manager plugin exposes functionality without enforcing authorization checks on requests. The plugin fails to verify that a caller has the required capability or nonce before executing protected operations. This design gap is classified under [CWE-862] Missing Authorization.

A remote attacker can send crafted HTTP requests to the plugin's exposed endpoints and trigger actions that should be reserved for privileged users. Because the vulnerability requires no authentication and no user interaction, any internet-reachable WordPress site running the vulnerable plugin is exposed. The EPSS probability is 0.249% with a percentile of 16.342, reflecting current exploitation likelihood observed in the wild.

Root Cause

The root cause is the absence of capability and nonce verification within the plugin's request handlers. WordPress plugins are expected to call current_user_can() and check_admin_referer() or wp_verify_nonce() before performing state-changing operations. The Video List Manager plugin omits these checks in the affected code paths, exposing functionality to unauthenticated callers.

Attack Vector

An attacker sends HTTP requests to the vulnerable plugin endpoints from a remote network location. No credentials, tokens, or user interaction are required. Successful requests invoke plugin actions and produce a limited integrity impact on stored data. Confidentiality and availability are not affected based on the published CVSS metrics.

No public proof-of-concept exploit code is currently listed for CVE-2025-49986. Refer to the Patchstack Vulnerability Report for advisory details.

Detection Methods for CVE-2025-49986

Indicators of Compromise

Unauthenticated HTTP POST or GET requests to admin-ajax.php or plugin-specific endpoints referencing Video List Manager actions.
Unexpected modifications to video list entries, posts, or plugin-controlled records without corresponding administrator sessions.
Access log entries showing repeated requests to plugin endpoints from a single IP address without prior authenticated sessions.

Detection Strategies

Inventory WordPress installations and identify sites where the video-list-manager plugin is installed at version 1.7 or earlier.
Review web server access logs for requests targeting plugin endpoints from unauthenticated sources.
Correlate database changes to plugin-owned tables with authenticated admin sessions to detect unauthorized modifications.

Monitoring Recommendations

Enable WordPress audit logging to capture plugin action invocations and identify calls lacking user context.
Deploy a Web Application Firewall (WAF) rule to flag unauthenticated requests to Video List Manager endpoints.
Monitor for anomalous integrity changes to plugin data, particularly outside normal administrator activity windows.

How to Mitigate CVE-2025-49986

Immediate Actions Required

Identify WordPress sites running the Video List Manager plugin at version 1.7 or earlier and prioritize remediation.
Deactivate and remove the video-list-manager plugin if a patched release is not yet available for your environment.
Restrict access to /wp-admin/admin-ajax.php and plugin endpoints via WAF rules until a fix is applied.

Patch Information

At the time of publication, no vendor-supplied patched version is referenced in the enriched CVE data. Consult the Patchstack Vulnerability Report for the current fix status and any available updates from the plugin author.

Workarounds

Disable the Video List Manager plugin until a patched release becomes available.
Apply WAF rules that block unauthenticated requests to plugin-specific endpoints and enforce nonce presence.
Restrict administrative endpoints by IP allowlisting where operationally feasible.

bash

# Disable the vulnerable plugin via WP-CLI
wp plugin deactivate video-list-manager
wp plugin delete video-list-manager