The vulnerability CVE-2025-3880 affects the Poll, Survey & Quiz Maker Plugin by Opinion Stage for WordPress, allowing authenticated users with Contributor-level permissions or above to bypass intended authorization checks. This flaw permits unauthorized modification of account connection details, specifically changing the email address and disconnecting the plugin. The issue stems from a misconfigured capability check on several functions in all versions up to and including 19.9.0. Although the plugin can be disconnected, existing content remains accessible and operational. The CVSS v3.1 base score is 4.3, indicating medium severity, with an attack vector over the network, low attack complexity, and no user interaction required.

An attacker with Contributor-level access or higher can alter the email address linked to the plugin account and disconnect the plugin, potentially disrupting plugin management or integration. However, the vulnerability does not allow for content deletion or direct confidentiality or availability impact on the created content, which remains functional and visible. There is no indication of privilege escalation beyond Contributor-level or of remote unauthenticated exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access to trusted users only and monitor plugin account settings for unauthorized changes. No official patch or workaround information is currently provided.