Missing Authorization Vulnerability in Media Hygiene by WordPress
CVE-2025-49979

4.3MEDIUM

Key Information:

Vendor

WordPress
Status
Media Hygiene
Vendor
CVE Published:
20 June 2025

What is CVE-2025-49979?

A missing authorization vulnerability has been identified in the Media Hygiene plugin for WordPress. This flaw allows attackers to exploit incorrectly configured access control security levels, potentially granting unauthorized access to sensitive areas of the application. The issue affects Media Hygiene from version n/a to 4.0.1. It is crucial for users of this plugin to assess their security configurations and apply necessary updates to mitigate the risks associated with this vulnerability.

Affected Version(s)

Media Hygiene <= 4.0.1

References

https://patchstack.com/database/wordpress/plugin/media-hy...
vdb-entry

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nguyen Tran Tuan Dung (domiee13) (Patchstack Alliance)
.
CVE-2025-49979 : Missing Authorization Vulnerability in Media Hygiene by WordPress