CVE-2025-24648
Published: 04 February 2025
Description
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Security Summary
CVE-2025-24648 is an Incorrect Privilege Assignment vulnerability (CWE-266) in the Bowo Admin and Site Enhancements (ASE) WordPress plugin (admin-site-enhancements), enabling privilege escalation. Published on 2025-02-04, it affects all versions of the plugin from n/a through 7.6.2.1. The vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), rated as High severity.
The attack requires network access and low privileges (such as a low-level authenticated WordPress user), but demands high attack complexity with no user interaction needed. Exploitation allows an attacker to escalate privileges, potentially gaining unauthorized high-level access within the affected WordPress site and achieving high impacts on confidentiality, integrity, and availability.
Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/admin-site-enhancements/vulnerability/wordpress-admin-and-site-enhancements-ase-plugin-7-6-1-1-privilege-escalation-vulnerability?_s_id=cve.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The vulnerability is an incorrect privilege assignment in a WordPress plugin that directly enables an authenticated low-privilege user to escalate to high-level access, mapping to Exploitation for Privilege Escalation.