CVE-2025-13496 is a missing authorization vulnerability (CWE-862) in the Moosend Landing Pages plugin for WordPress. The issue arises because the moosend_landings_auth_get function lacks proper capability checks, enabling authenticated users with Subscriber-level privileges or higher to delete the 'moosend_landing_api_key' option. This can lead to unauthorized modification of plugin data. The vulnerability affects all versions up to and including 1.1.6. The CVSS 3.1 base score is 5.3, indicating medium severity. No patch or official fix has been documented in the provided data.

An attacker with at least Subscriber-level access to a WordPress site using the vulnerable Moosend Landing Pages plugin can delete the 'moosend_landing_api_key' option. This unauthorized modification could disrupt the plugin's functionality that relies on this API key, potentially impacting integration or service availability. There is no indication of confidentiality or availability impact beyond this modification. No known exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles to minimize the number of users with Subscriber-level or higher access, and monitor for unauthorized changes to plugin options. Avoid granting unnecessary privileges to users. Follow vendor channels for updates regarding a patch or official mitigation.