CVE-2025-58660 Overview
CVE-2025-58660 is a missing authorization vulnerability in the Oshine Core plugin by brandexponents for WordPress. The flaw affects all versions of oshine-core up to and including 1.5.5. Attackers with low-privilege authenticated access can exploit incorrectly configured access control checks to interact with plugin functionality that should require higher privileges. The issue is categorized under CWE-862: Missing Authorization and carries a CVSS 3.1 base score of 5.4. The vulnerability was published to the National Vulnerability Database on September 22, 2025.
Critical Impact
Authenticated users with low privileges can bypass access control checks in the Oshine Core plugin, leading to limited integrity and availability impact on affected WordPress sites.
Affected Products
- brandexponents Oshine Core (oshine-core) plugin for WordPress
- All versions from n/a through 1.5.5
- WordPress sites bundling the Oshine theme ecosystem that ship this plugin
Discovery Timeline
- 2025-09-22 - CVE-2025-58660 published to the National Vulnerability Database
- 2026-06-17 - Last updated in the NVD database
Technical Details for CVE-2025-58660
Vulnerability Analysis
The Oshine Core plugin exposes plugin actions that lack proper authorization enforcement. WordPress plugins commonly register AJAX endpoints and admin-post handlers that must validate the caller's capability using functions such as current_user_can() alongside nonce verification. When these checks are missing or misconfigured, any authenticated user, including subscriber-level accounts, can invoke privileged functionality.
According to the Patchstack Vulnerability Report, the flaw is a broken access control issue that permits actions outside the intended privilege boundary. The EPSS score for this CVE is 0.266%, placing it in the 18.57 percentile for exploitation likelihood.
Root Cause
The root cause is the absence of authorization checks on plugin request handlers. The plugin fails to verify the acting user's role or capability before executing sensitive operations. This maps directly to [CWE-862], where a security decision relies on authentication alone rather than authorization.
Attack Vector
Exploitation requires network access and a low-privilege authenticated session on the target WordPress site. An attacker sends a crafted HTTP request to the vulnerable plugin endpoint. Because the endpoint does not enforce a capability check, the request completes with the effect of a higher-privileged action. User interaction is not required.
No verified public exploit code is available for this vulnerability. Refer to the vendor advisory for technical details on the affected handlers.
Detection Methods for CVE-2025-58660
Indicators of Compromise
- Unexpected POST requests from low-privilege accounts to wp-admin/admin-ajax.php or admin-post.php referencing Oshine Core actions.
- Unauthorized modifications to WordPress content, options, or plugin-managed settings performed by subscriber or contributor accounts.
- New or modified site content that originates from user roles that should not have publishing or configuration rights.
Detection Strategies
- Audit WordPress access logs for requests to Oshine Core AJAX action names issued by non-administrator users.
- Compare current plugin file hashes against a known-good oshine-core 1.5.5 installation to detect tampering following exploitation.
- Review the WordPress wp_options table and post revisions for unexpected changes correlated with low-privilege user activity.
Monitoring Recommendations
- Forward WordPress web server and application logs to a centralized analytics platform for role-based anomaly detection.
- Alert on privilege-context mismatches, where a low-privilege session performs an action normally reserved for editors or administrators.
- Track spikes in authenticated AJAX requests targeting plugin endpoints, particularly after user registration events.
How to Mitigate CVE-2025-58660
Immediate Actions Required
- Identify all WordPress sites running the Oshine Core plugin at version 1.5.5 or earlier.
- Disable the plugin on affected sites until a patched release is applied, if operational impact is acceptable.
- Review and reduce open user registration, and audit existing low-privilege accounts for signs of abuse.
- Rotate WordPress account credentials and API keys if unauthorized activity is observed.
Patch Information
At the time of publication, the Patchstack Vulnerability Report lists the vulnerability as affecting versions up to and including 1.5.5. Administrators should consult the Patchstack entry and the brandexponents vendor channel for the fixed release and upgrade guidance.
Workarounds
- Restrict access to wp-admin/admin-ajax.php and admin-post.php at the web application firewall for unauthenticated and low-privilege users where feasible.
- Enforce strict role assignments and disable self-registration on sites that do not require public account creation.
- Deploy a virtual patch through a WordPress-focused WAF rule set that blocks known Oshine Core plugin action names from non-privileged sessions.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.