CVE-2025-69331
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
The Theater for WordPress plugin (versions up to and including 0.19) contains a Missing Authorization vulnerability due to incorrectly configured access control security levels. This allows exploitation of improperly configured authorization mechanisms.
Risk Assessment
An attacker may perform operations they are not authorized to, potentially resulting in unauthorized changes to site configuration or content.
Recommendation
Update the Theater for WordPress plugin to a version newer than 0.19 once a fix is released, and review user permissions.
Other vulnerabilities in Theater for WordPress
See all- CVE-2025-64259Medium
The Theater for WordPress plugin has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. The issue affects versions up to and including 0.18.8.
- CVE-2025-58020Medium
The Theater for WordPress plugin (versions up to 0.18.8) is vulnerable to stored XSS due to improper input neutralization during web page generation. Attackers can inject malicious scripts.
Original NVD description (English source)
Missing Authorization vulnerability in Jeroen Schmit Theater for WordPress theatre allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Theater for WordPress: from n/a through <= 0.19.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS