Team <= 5.0.6 - Missing Authorization
2025-09-22 00:00
Que Thanh Tuan - Blue RockStrategic Overview
StatusPatched in 5.0.7
Affected PluginTeam – Team Members Showcase Plugin
Affected Version
<= 5.0.6CVSS5.4Medium
CVE
CVE-2025-57975Vulnerability Overview
The Team plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 5.0.6. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.
Technical Analysis
REMEDIATION: Update to version 5.0.7, or a newer patched version --- IDENTIFIER: CWE-862 (Missing Authorization) The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C