CVE-2025-2933 is a missing authorization vulnerability (CWE-862) in the Email Notifications for Updates WordPress plugin affecting all versions up to 1.1.6. The awun_import_settings() function lacks proper capability checks, allowing authenticated users with low privileges (Subscriber and above) to update arbitrary WordPress options. This can be exploited to elevate privileges by setting the default registration role to administrator and enabling user registration, thereby granting attackers administrative access. The vulnerability is rated high severity with a CVSS 3.1 base score of 8.8 (Network attack vector, Low attack complexity, Privileges required: Low, No user interaction, impacts Confidentiality, Integrity, and Availability). There is no vendor advisory or patch link available at this time.

Successful exploitation allows an authenticated attacker with minimal privileges to escalate their access to administrator level by modifying WordPress site options. This compromises site confidentiality, integrity, and availability by enabling unauthorized administrative control and potential further malicious actions on the affected WordPress site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles to trusted users only and consider disabling or removing the Email Notifications for Updates plugin if possible. Monitor for updates from the plugin vendor or WordPress security sources for an official patch or mitigation.