CVE-2025-11255 is a missing authorization vulnerability (CWE-862) in the Password Policy Manager | Password Manager WordPress plugin by cyberlord92. The flaw exists because the 'moppm_ajax' AJAX endpoint does not perform proper capability checks, allowing authenticated users with low privileges (Subscriber-level and above) to trigger actions that log out the site's connection to miniorange. This vulnerability affects all plugin versions up to 2.0.5 and does not require user interaction. The CVSS 3.1 base score is 4.3 (medium severity), reflecting network attack vector, low complexity, low privileges required, no user interaction, unchanged scope, no confidentiality or availability impact, and limited integrity impact.

Exploitation allows authenticated users with Subscriber-level access or higher to forcibly log out the site's connection to miniorange, potentially disrupting authentication or integration services relying on that connection. There is no direct confidentiality or availability impact reported. The integrity impact is limited to unauthorized modification of session or connection state.

No official patch or fix is currently available as per the provided data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict Subscriber-level access to trusted users only and monitor for suspicious activity related to the miniorange connection. Avoid granting unnecessary privileges to low-level authenticated users.