CVE-2025-2815

CVE-2025-2815, published on 2025-03-28, is a vulnerability in the Administrator Z plugin for WordPress affecting all versions up to and including 2025.03.24. It stems from a missing capability check in the adminz_import_backup() function, enabling unauthorized modification of data that results in privilege escalation. The issue carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-862 (Missing Authorization). CVE-2025-26959 is a duplicate of this vulnerability.

Authenticated attackers with Subscriber-level access or higher can exploit this flaw over the network with low complexity and no user interaction required. By calling the vulnerable function, they can update arbitrary WordPress site options, such as setting the default role for new user registrations to administrator and enabling registration. This allows attackers to self-register as administrators, achieving full site compromise including high confidentiality, integrity, and availability impacts.

Advisories from Wordfence and the WordPress plugin trac provide details on the issue, with a patch committed in the Administrator Z plugin repository at changeset 3262319. Security practitioners should update the plugin to a version after 2025.03.24 to mitigate the vulnerability.