CVE-2025-49906
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
The WPComplete plugin has a missing authorization vulnerability, allowing access to functionality not properly constrained by ACLs. Affects versions up to and including 2.9.5.3.
Risk Assessment
Unauthorized users may perform operations they are not entitled to, potentially leading to data integrity issues or privilege escalation.
Recommendation
Update the WPComplete plugin to the latest patched version. Review and configure proper permissions for user roles.
Other vulnerabilities in WPComplete
See all- CVE-2026-66599High
Unauthenticated Cross Site Scripting (XSS) in WPComplete versions up to 2.9.5.6. Allows injecting malicious script into the page.
- CVE-2026-77820Medium
The WPComplete plugin for WordPress (versions up to and including 2.9.9.0) is vulnerable to Stored Cross-Site Scripting via the 'empty' Shortcode Attribute due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts into pages that execute whenever a user accesses an injected page. This requires the premium version of the software. Please note this only affects the pro version.
Original NVD description (English source)
Missing Authorization vulnerability in StellarWP WPComplete wpcomplete allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WPComplete: from n/a through <= 2.9.5.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS