CVE-2025-11887 is a missing authorization vulnerability (CWE-862) in the Supervisor WordPress plugin by tiagohillebrandt. The plugin fails to enforce capability checks on multiple AJAX endpoints, enabling authenticated users with low-level privileges (Subscriber and above) to update plugin settings improperly. This vulnerability is present in all versions up to 1.3.2. The CVSS 3.1 base score is 4.3, reflecting a medium severity with network attack vector, low attack complexity, and requiring privileges but no user interaction. No known exploits in the wild have been reported, and no patch or vendor advisory is currently available.

An attacker with authenticated Subscriber-level access or higher can modify plugin settings without authorization. This could lead to unauthorized changes in the plugin's behavior or configuration, potentially impacting site functionality or security posture. There is no indication of confidentiality or availability impact, only integrity impact limited to the plugin settings.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict plugin usage to trusted users only and consider limiting Subscriber-level access where possible. Monitor official channels for updates from the plugin developer regarding patches or mitigations.