CVE-2025-2779 is a missing authorization vulnerability (CWE-862) in the Insert Headers and Footers Code – HT Script WordPress plugin. The ajax_dismiss function lacks proper capability checks, permitting authenticated users with low privileges (Subscriber and above) to update option values to true. This can disrupt site functionality by causing errors or enabling features like registration without proper authorization. The vulnerability affects all versions up to and including 1.1.2. No known exploits are reported in the wild, and no patch information is provided.

An attacker with Subscriber-level access or higher can modify plugin options, potentially causing site errors or enabling unauthorized features such as user registration. This can disrupt normal site operations and deny access to legitimate users. There is no indication of direct confidentiality or availability impact beyond these effects.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles to trusted users only and monitor for unusual changes in site options related to this plugin. Avoid granting Subscriber or higher privileges to untrusted users.