WordPress Plugin Vulnerabilities

Team < 5.0.7 - Missing Authorization

Description

The Team plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 5.0.6. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.

Affects Plugins

Plugin icon
tlp-team
Fixed in 5.0.7

References

CVE
CVE-2025-57975
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/e16b8686-a502-4a73-b955-10f2800fd5dc

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.4 (medium)

Miscellaneous

Original Researcher
Que Thanh Tuan - Blue Rock
Verified
No
WPVDB ID
067cf0a8-d114-41bf-906a-bb993e579bf4

Timeline

Publicly Published
2025-09-22 (about 11 months ago)
Added
2025-09-26 (about 10 months ago)
Last Updated
2025-10-02 (about 10 months ago)

Other

Published
Title
Published
2026-08-04
Title
Xpro Addons < 1.5.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Creation via get_menu_content_editor() Function
Published
2026-02-11
Title
LatePoint – Calendar Booking Plugin for Appointments and Events < 5.2.7 - Missing Authorization to Booking Details Exposure
Published
2022-08-25
Title
Accommodation System <= 1.0.1 - Subscriber+ Unauthorised Actions
Published
2026-01-06
Title
Unify < 3.4.10 - Missing Authorization to Unauthenticated Option Deletion via 'unify_plugin_downgrade' Parameter
Published
2022-11-01
Title
WatchTowerHQ < 3.6.16 - Unauthenticated Arbitrary File Deletion