Salvador AI Image Generator plugin broken access control (CVE-2025-23954)
The Salvador – AI Image Generator WordPress plugin version 1.0.11 and earlier contains a broken access control vulnerability allowing subscribers to access unauthorized pages and data. The vulnerability was assigned CVE-2025-23954 with a CVSS score of 4.3 and is rated as low severity.
What happened
The Salvador – AI Image Generator WordPress plugin version 1.0.11 and earlier contains a broken access control vulnerability tracked as CVE-2025-23954.
Users with subscriber-level privileges can access pages or perform actions they should not be allowed to, such as viewing other people's data.
Reported impact
The vulnerability is classified as having low severity with a CVSS score of 4.3.
Index analysis
The security issue has low severity impact and is unlikely to be exploited.
Governance controls
No official patch was available as of the report date. Users were advised to update the affected plugin or request assistance from their hosting provider or web developer.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.