CVE-2025-49913

MediumCVSS 5.3

Published: 22/10/2025(UTC)Updated: 19/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.35%

27th percentile - higher than 27% of all known CVEs

Summary

The CoSchedule plugin by CoSchedule (coschedule-by-todaymade) contains a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This affects CoSchedule versions up to and including 3.4.0.

Risk Assessment

An unauthorized user may access functionality or data they should not have access to, potentially compromising the WordPress site's security.

Recommendation

Upgrade the CoSchedule plugin to a version later than 3.4.0 as soon as it becomes available.

Other vulnerabilities in CoSchedule

CVE-2025-60119Medium
The CoSchedule plugin (versions up to and including 3.3.11) exposes sensitive system information to an unauthorized control sphere. This allows retrieval of embedded sensitive data.

Original NVD description (English source)

Missing Authorization vulnerability in CoSchedule CoSchedule coschedule-by-todaymade allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CoSchedule: from n/a through <= 3.4.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS