CVE-2025-2103 is a missing authorization vulnerability (CWE-862) in the SoundRise Music plugin for WordPress by IronTemplates. The vulnerability exists because the theironMusic_ajax() function does not perform proper capability checks, allowing authenticated users with low privileges (subscriber and above) to update arbitrary WordPress options. This can be exploited to escalate privileges by setting the default registration role to administrator and enabling user registration, thereby granting attackers administrative access to the site. The vulnerability affects all versions up to and including 1.6.11. The CVSS 3.1 base score is 8.8, indicating high severity with network attack vector, low attack complexity, and no user interaction required.

Successful exploitation allows authenticated users with minimal privileges to escalate to full administrative control of the WordPress site. This compromises confidentiality, integrity, and availability of the site by enabling unauthorized modification of critical settings and creation of administrative accounts.

No official patch or fix is currently available from the vendor. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict subscriber-level user access and disable user registration if not required to reduce attack surface. Monitor for updates from IronTemplates regarding an official fix.