CVE-2025-57975 Overview
CVE-2025-57975 is a Missing Authorization vulnerability [CWE-862] in the RadiusTheme Team plugin (tlp-team) for WordPress. The flaw affects all versions up to and including 5.0.6. An authenticated attacker with low-level privileges can exploit incorrectly configured access control checks to perform actions that should require higher privileges.
The vulnerability stems from missing authorization validation on plugin endpoints. Attackers do not need administrative access to trigger the affected functionality. Exploitation requires network access and low-privilege authentication, with no user interaction.
Critical Impact
Authenticated low-privilege users on WordPress sites running the tlp-team plugin can access plugin functionality without proper authorization checks, leading to limited information disclosure.
Affected Products
- RadiusTheme Team plugin (tlp-team) for WordPress
- All versions from initial release through 5.0.6
- WordPress sites with the plugin installed and activated
Discovery Timeline
- 2025-09-22 - CVE-2025-57975 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-57975
Vulnerability Analysis
The vulnerability is a broken access control issue in the RadiusTheme Team WordPress plugin. The plugin exposes functionality that fails to verify whether the requesting user has the appropriate capability or role. This maps to Common Weakness Enumeration [CWE-862] Missing Authorization.
An attacker who holds any authenticated session on the target WordPress instance can invoke affected plugin endpoints. The exposure is limited to confidentiality impact, with no direct integrity or availability consequences per the published scoring.
Root Cause
The root cause is the absence of capability checks such as current_user_can() on plugin handlers. When plugin endpoints process AJAX or REST requests without validating the caller's role, any authenticated subscriber can reach code paths intended for higher-privileged users. This is a common pattern in WordPress plugin vulnerabilities where authentication is verified but authorization is not.
Attack Vector
Exploitation requires network access to the WordPress site and a valid low-privilege account, such as a subscriber. The attacker sends crafted HTTP requests to plugin endpoints exposed by tlp-team. Because the endpoints lack proper role validation, the requests are processed and return data or perform actions restricted to elevated roles.
No user interaction is required beyond the attacker's own authenticated session. Refer to the Patchstack Vulnerability Report for endpoint-specific technical details.
Detection Methods for CVE-2025-57975
Indicators of Compromise
- Unexpected HTTP POST or GET requests to tlp-team plugin AJAX endpoints (paths containing admin-ajax.php with tlp_team or rttlp_team actions) originating from low-privilege user sessions.
- WordPress audit log entries showing subscriber-level accounts accessing team management functionality.
- Anomalous data access patterns from newly registered or dormant WordPress user accounts.
Detection Strategies
- Review web server access logs for requests to plugin endpoints correlated with non-administrative session cookies.
- Deploy a web application firewall rule to flag requests to tlp-team handlers that lack administrator authentication context.
- Monitor WordPress security plugins for capability check failures or authorization warnings tied to tlp-team.
Monitoring Recommendations
- Enable verbose logging on WordPress AJAX and REST endpoints to capture caller identity and action names.
- Alert on requests to plugin endpoints where the authenticated user role does not match the endpoint's expected privilege level.
- Track creation of new low-privilege user accounts followed by immediate access to plugin functionality.
How to Mitigate CVE-2025-57975
Immediate Actions Required
- Inventory all WordPress installations to identify sites running the RadiusTheme Team plugin (tlp-team) at version 5.0.6 or earlier.
- Update tlp-team to a version above 5.0.6 once the vendor releases a patched release.
- Restrict new user registration on affected sites until the plugin is updated or removed.
- Audit existing WordPress user accounts and remove unused or unrecognized low-privilege accounts.
Patch Information
At the time of publication, the vulnerability affects tlp-team versions up to and including 5.0.6. Consult the Patchstack Vulnerability Report for the latest fixed version information and vendor advisory updates.
Workarounds
- Deactivate and remove the tlp-team plugin if it is not required for site operation.
- Deploy a web application firewall rule that blocks non-administrator requests to tlp-team AJAX and REST endpoints.
- Disable public user registration in WordPress settings to prevent attackers from obtaining the low-privilege account required for exploitation.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.