CVE-2025-28874: WordPress BP Email Assign Templates By shanebp plugin <= 1.7 - Arbitrary Content Deletion vulnerability

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• shanebp bp email assign templatesbefore 1.8

Versions reported by the vendor

Affected version ranges reported by the assigning authority (Patchstack). Independent of NVD's CPE analysis and usually ahead of it.

• shanebp BP Email Assign Templates

  • up to and including 1.7affectedfixed in 1.8

Other highest-scoring records for the same primary product.

• CVE-2025-24631WordPress BP Email Assign Templates Plugin <= 1.5 - Reflected Cross Site Scripting (XSS) vulnerability
  28Monitor
• CVE-2024-12441BP Email Assign Templates <= 1.5 - Reflected Cross-Site Scripting
  24Monitor
• CVE-2025-28875WordPress BP Email Assign Templates By shanebp plugin <= 1.6 - Cross-Site Scripting vulnerability
  19Monitor

Root cause

The endpoint fetches the record by the ID sent in the request, but never checks whether the record belongs to the requesting user.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1const invoice = await Invoice.findById(req.params.id);2res.json(invoice);

1const invoice = await Invoice.findOne({2  id: req.params.id,3  ownerId: req.user.id,4});5if (!invoice) return res.sendStatus(404);6res.json(invoice);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.

MITRE has no CAPEC/ATT&CK mapping for this CWE.