CVE-2025-69188CWE-862

WordPress fitness-trainer plugin <= 1.7.1 - Broken Access Control vulnerability

High · published January 22, 2026

CVSS v3.1
7.3
EPSS
0%
Percentile
16.8
In the wild
Unconfirmed
What it is

⚡ Missing authorization means anyone can take a peek behind the curtain! This misconfiguration in e-plugins fitness-trainer could let users access sensitive data without breaking a sweat! Think of it like a gym locker room where the door to the VIP area is wide open — anyone can stroll in and access personal belongings without a key. In this case, improper access controls are letting unauthorized users bypass the security levels designed to keep sensitive information safe. This vulnerability could allow an attacker to exploit these access control flaws, potentially accessing private user information or modifying settings without permission. The consequences could be far-reaching, including data breaches and loss of user trust — absolutely devastating for any fitness platform!

Put simply

Think of it like a gym locker room where the door to the VIP area is wide open — anyone can stroll in and access personal belongings without a key. In this case, improper access controls are letting unauthorized users bypass the security levels designed to keep sensitive information safe. The missing authorization vulnerability in e-plugins fitness-trainer allows attackers to exploit incorrectly configured access control security levels. This means unauthorized users can access areas of the application that should be restricted, leading to potential data exposure.

What to do

This vulnerability could allow an attacker to exploit these access control flaws, potentially accessing private user information or modifying settings without permission. The consequences could be far-reaching, including data breaches and loss of user trust — absolutely devastating for any fitness platform! To fix this issue, review and configure access control settings to ensure they are correctly enforced. Immediately patch to version 1.7.2 or later to secure your application against unauthorized access. Don't forget to conduct a thorough audit of your user permissions! You've got this! With these steps, you can lock down your fitness-trainer application like a pro! 🛡️

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00260 · 16.8th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-01-22T16:52Z
EPSS history
Timeline
  • 22 JAN 16:52Z
    WordPress fitness-trainer plugin <= 1.7.1 - Broken Access Control vulnerability
    cvelistv5