CVE-2025-2933 Details

A vulnerability in the Email Notifications for Updates plugin for WordPress, affecting all versions through 1.1.6, allows for unauthorized data modification that could lead to privilege escalation. The issue arises from a missing capability check in the awun_import_settings() function, enabling authenticated attackers with Subscriber-level access or higher to update arbitrary options on the WordPress site. This vulnerability could be exploited to change the default role for new users to administrator and activate user registration, potentially granting administrative access to the attacker on the compromised site.

Users are advised to update the Email Notifications for Updates plugin to version 1.2.0 or later.