Access Control Vulnerability in CoSchedule by Todaymade
CVE-2025-49913

5.3MEDIUM

Key Information:

Vendor

WordPress
Status
Coschedule
Vendor
CVE Published:
22 October 2025

What is CVE-2025-49913?

A vulnerability affecting the CoSchedule plugin by Todaymade allows unauthorized access due to incorrectly configured access control security levels. This flaw can be exploited by attackers to gain elevated permissions, potentially compromising the integrity of the affected WordPress site. The issue exists in CoSchedule versions up to and including 3.4.0, making it critical for users to ensure their installations are updated and properly configured to mitigate the risk.

Affected Version(s)

CoSchedule <= n/a

References

https://vdp.patchstack.com/database/Wordpress/Plugin/cosc...
vdb-entry

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

daroo (Patchstack Alliance)
JSON
.