Unauthorized Data Modification in Email Notifications for Updates Plugin by WordPress

CVE-2025-2933

What is CVE-2025-2933?

The Email Notifications for Updates plugin for WordPress contains a vulnerability that enables unauthorized data modification due to a lack of capability checks in the awun_import_settings() function. This flaw affects all versions up to and including 1.1.6. Authenticated attackers with Subscriber-level access or higher can exploit this vulnerability to change critical settings, such as the default user registration role to administrator and allow user registrations. Consequently, this may lead to unauthorized users gaining administrative access to the WordPress site, posing a significant security risk.

References