CVE-2023-3325

CVE-2023-3325 is a critical authorization bypass vulnerability affecting the CMS Commander plugin for WordPress, specifically in versions up to and including 2.287. This flaw allows unauthenticated attackers to manipulate the plugin's configuration due to an insufficiently unique cryptographic signature, enabling access to remote control functionalities. The vulnerability carries a CVSS score of 9.8 (Critical) due to its network-based attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. While exploitation is limited to unconfigured plugins, it can lead to privilege escalation if combined with other vulnerabilities, but there is currently no evidence of active exploitation, public exploit code, or significant community discussion.