CVE-2025-24648 WordPress Admin and Site Enhancements (ASE) Plugin <= 7.6.2.1 - Privilege Escalation vulnerability
Attackers can escalate privileges due to incorrect privilege assignment in the Admin and Site Enhancements WordPress plugin.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-24648?
CVE-2025-24648 is a high-severity vulnerability in Bowo Admin and Site Enhancements (ASE), published on 4 Feb 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Incorrect Privilege Assignment vulnerability in Bowo Admin and Site Enhancements (ASE) admin-site-enhancements allows Privilege Escalation.This issue affects Admin and Site Enhancements (ASE): from n/a through <= 7.6.2.1.
Weakness: CWE-266
Which versions are affected by CVE-2025-24648?
How do I fix CVE-2025-24648?
No fix has been published for CVE-2025-24648 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-24648 being exploited?
There is no known exploitation of CVE-2025-24648 in the wild and no public exploit code.
Sources
Also known as GHSA-qf6w-wr4m-8jw6.