CVE-2025-48339 is a CWE-862 missing authorization vulnerability in the activity-log.com Profiler - What Slowing Down Your WP plugin, affecting versions through 1.0.0. The vulnerability arises from incorrectly configured access control security levels, allowing unauthorized users to access or perform actions that should be restricted. The CVSS 3.1 score of 6.5 reflects a medium severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts confidentiality and integrity but not availability. There are no patches or vendor advisories currently available, and no known exploits in the wild have been reported.

The vulnerability could allow unauthorized users to access or manipulate data or functionality within the affected plugin due to missing authorization checks. This impacts the confidentiality and integrity of the system but does not affect availability. Since no known exploits are reported, the immediate risk appears limited, but exploitation could lead to unauthorized information disclosure or modification.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should restrict access to the plugin’s administrative interfaces and monitor for suspicious activity. Applying principle of least privilege and reviewing access control configurations may help reduce exposure. Stay alert for vendor updates to apply official patches promptly once available.