CVE-2025-13091 is a vulnerability in the Shopire WordPress theme caused by a missing capability check in the shopire_admin_install_plugin() function. This allows authenticated users with low privileges (Subscriber-level and above) to install plugins, specifically the 'fable-extra' plugin, without proper authorization. The vulnerability affects all versions up to 1.0.57. The CVSS 3.1 base score is 4.3 (medium severity), with network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact. No known exploits in the wild or vendor patches are currently documented.

An attacker with Subscriber-level access or higher can install unauthorized plugins on a vulnerable Shopire WordPress site, potentially leading to unauthorized modifications of site functionality or configuration. The integrity of the system can be impacted, but confidentiality and availability are not affected according to the CVSS vector. This could facilitate further attacks depending on the installed plugin's capabilities.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Subscriber-level access to trusted users only and monitor for unauthorized plugin installations. Avoid granting unnecessary privileges to low-level authenticated users.