CVE-2025-11172 is a missing authorization vulnerability (CWE-862) in the Check Plagiarism WordPress plugin. The vulnerability arises because the chk_plag_mine_plugin_wpse10500_admin_action() function does not perform capability checks, enabling authenticated users with Subscriber privileges or higher to update the API key. This issue affects all plugin versions up to 2.0. The vulnerability has a CVSS 3.1 base score of 4.3, reflecting a medium severity with network attack vector, low attack complexity, and requiring low privileges with no user interaction.

An attacker with at least Subscriber-level access can modify the API key used by the plugin. This unauthorized modification could potentially disrupt plugin functionality or lead to misuse of the API key. There is no direct confidentiality or availability impact reported. No known active exploitation has been observed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles to trusted users only and monitor for unauthorized changes to plugin settings. Avoid granting Subscriber-level or higher access to untrusted users.