Unauthorized Tracking Modification in Employee Spotlight Plugin for WordPress

CVE-2025-13403

What is CVE-2025-13403?

The Employee Spotlight – Team Member Showcase & Meet the Team Plugin for WordPress is susceptible to unauthorized modifications of tracking settings. This vulnerability is due to the lack of proper authorization validation in the employee_spotlight_check_optin() function. Authenticated attackers with Subscriber-level access and above can exploit this flaw, enabling or disabling tracking settings at will. All versions of the plugin up to and including 5.1.3 are affected, highlighting the imperative for users to review their installed plugins and apply updates promptly.

References