WordPress Plugin Vulnerabilities

Text To Speech TTS Accessibility < 1.9.31 - Missing Authorization

Description

The plugin is vulnerable to unauthorized access due to a missing capability check on a function. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.

Affects Plugins

Plugin icon
text-to-audio
Fixed in 1.9.31

References

CVE
CVE-2025-58664
URL
https://patchstack.com/database/wordpress/plugin/text-to-audio/vulnerability/wordpress-text-to-speech-tts-accessibility-plugin-1-9-20-broken-access-control-vulnerability

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.4 (medium)

Miscellaneous

Original Researcher
Denver Jackson
Verified
No
WPVDB ID
3f197ef9-62b0-4248-b18c-abb6b1927e24

Timeline

Publicly Published
2025-09-22 (about 11 months ago)
Added
2025-09-26 (about 11 months ago)
Last Updated
2025-11-24 (about 9 months ago)

Other

Published
Title
Published
2024-11-22
Title
WP User Manager – User Profile Builder & Membership < 2.9.12 - Missing Authorization to Carbon Fields Custom Sidebar Addition/Removal
Published
2025-07-15
Title
URL Shortener <= 3.0.7 - Missing Authorization
Published
2026-03-04
Title
e2pdf < 1.32.00 - Missing Authorization
Published
2025-03-25
Title
Ultimate Dashboard < 3.8.8 - Missing Authorization to Authenticated (Subscriber+) Plugin Modules Activation/Deactivation
Published
2024-08-16
Title
WOOCS – WooCommerce Currency Switcher < 1.4.2.1 - Missing Authorization