CVE-2025-46255 is a missing authorization vulnerability (CWE-862) in the LoginWP - Pro plugin by Marketing Fire LLC. This flaw allows attackers to access functionality that is not properly constrained by access control mechanisms, potentially enabling unauthorized actions that affect the integrity of the system. The vulnerability affects all versions up to 4.0.8.5. According to the CVSS 3.1 vector, the attack can be performed remotely without authentication or user interaction, with a high impact on integrity but no impact on confidentiality or availability.

The vulnerability allows an unauthenticated attacker to perform unauthorized actions due to missing authorization checks, which can compromise the integrity of the affected system. There is no impact on confidentiality or availability. No known exploits have been reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or vendor advisory is currently available, monitor for updates from Marketing Fire LLC. Until a fix is released, restrict access to the affected plugin where possible and review permissions to limit exposure.