CVE-2025-32308 PUBLISHED

WordPress Team Builder <= 1.5.7 - Broken Access Control Vulnerability

Assigner: Patchstack
Reserved: 04.04.2025 Published: 09.06.2025 Updated: 10.06.2025

Missing Authorization vulnerability in looks_awesome Team Builder allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Team Builder: from n/a through 1.5.7.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
CVSS Score: 7.6

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	Low
Privileges Required	Low	Integrity Impact	High
User Interaction	None	Availability Impact	Low

CVSS 3.1

Product Status

Vendor	looks_awesome
Product	Team Builder
Versions	Default: unaffected affected from n/a to 1.5.7 (incl.)

Credits

Tran Nguyen Bao Khanh (VCI - VNPT Cyber Immunity) (Patchstack Alliance) finder

References

https://patchstack.com/database/wordpress/plugin/a-team-showcase/vulnerability/wordpress-team-builder-1-5-7-broken-access-control-vulnerability?_s_id=cve

Problem Types

CWE-862 Missing Authorization CWE

Impacts

CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels