CVE-2025-13403 is a missing authorization vulnerability (CWE-862) in the Employee Spotlight – Team Member Showcase & Meet the Team Plugin for WordPress. The issue arises because the employee_spotlight_check_optin() function does not properly validate whether the user is authorized to change tracking settings. Consequently, any authenticated user with at least Subscriber privileges can enable or disable tracking settings, potentially impacting user privacy or site analytics configuration. This affects all plugin versions up to 5.1.3. There is no indication of known exploits in the wild or an available patch at this time.

An attacker with Subscriber-level access or higher can modify tracking settings without authorization. This does not lead to confidentiality or availability impact but results in integrity impact limited to the tracking configuration. There is no evidence of exploitation in the wild or broader system compromise from this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Subscriber-level access where possible and monitor for unauthorized changes to tracking settings. Avoid granting unnecessary authenticated access to untrusted users.