CVE-2025-49900CWE-266

CVE-2025-49900

High · published November 6, 2025

CVSS v3.1
8.8
EPSS
0%
Percentile
27.8
In the wild
Unconfirmed
What it is

⚡ A sneaky privilege escalation vulnerability lets users do more than they should! The bPlugins Advanced Scrollbar, from versions n/a through 1.1.8, has a flaw that you definitely want to get fixed. 🔥 Think of this like a hotel where a guest accidentally stumbles into the staff-only area. With this flaw, a user can potentially gain access to restricted functionalities that should be off-limits, just like wandering into the kitchen when you were supposed to stay in the lobby! An attacker could exploit this flaw to escalate their privileges, allowing them to perform actions intended only for admin users. This could lead to unauthorized changes, access to sensitive data, or even taking complete control of the system — absolutely devastating!

Put simply

Think of this like a hotel where a guest accidentally stumbles into the staff-only area. With this flaw, a user can potentially gain access to restricted functionalities that should be off-limits, just like wandering into the kitchen when you were supposed to stay in the lobby! This privilege assignment vulnerability in the bPlugins Advanced Scrollbar allows lower-privileged users to gain escalated privileges, enabling them to perform unauthorized actions within the application.

What to do

An attacker could exploit this flaw to escalate their privileges, allowing them to perform actions intended only for admin users. This could lead to unauthorized changes, access to sensitive data, or even taking complete control of the system — absolutely devastating! Upgrade to the latest version of the Advanced Scrollbar to eliminate this vulnerability, ensuring you're beyond version 1.1.8. Regularly audit user permissions to ensure that access levels are properly enforced. 🛡️ You've got this! Addressing this vulnerability will help you keep your system secure and your users safe! 💪😊

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00354 · 27.8th percentile
Weakness
CWE-266 · Incorrect Privilege Assignment
Published
2025-11-06T21:15Z
References (1)
EPSS history
Timeline
  • 06 NOV 15:53Z
    WordPress Advanced scrollbar plugin <= 1.1.8 - Privilege Escalation vulnerability
    cvelistv5