What is the CVSS score of CVE-2025-28965?

CVE-2025-28965 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L. EPSS exploitation probability: 0.1%.

Wordpress Plugin CVE-2025-28965

HIGH

Missing Authorization (CWE-862)

2025-07-16 audit@patchstack.com

WordPress Authentication Bypass Wordpress Plugin

8.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

CVSS changed

Apr 23, 2026 - 15:42 NVD

8.6 (HIGH)

Analysis Generated

Apr 01, 2026 - 17:26 vuln.today

CVE Published

Jul 16, 2025 - 12:15 nvd

N/A

DescriptionCVE.org

Missing Authorization vulnerability in Md Yeasin Ul Haider URL Shortener exact-links allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects URL Shortener: from n/a through <= 3.0.7.

AnalysisAI

Missing authorization controls in the exact-links WordPress URL Shortener plugin (versions up to 3.0.7) allow unauthenticated or low-privileged attackers to access functionality that should be restricted by access control lists. The vulnerability stems from improper ACL enforcement, enabling unauthorized users to perform actions beyond their intended permissions without authentication requirements.

Technical ContextAI

The exact-links URL Shortener plugin fails to properly implement authorization checks (CWE-862: Missing Authorization) on sensitive functionality. The underlying issue is a broken access control mechanism where the application does not adequately verify user permissions before granting access to restricted features. This is a common vulnerability in WordPress plugins where developers forget to implement capability checks via functions like current_user_can() or fail to validate nonce tokens before processing administrative or user-restricted operations. The plugin's architecture appears to expose functionality endpoints without proper ACL validation, allowing direct access bypass.

Affected ProductsAI

The exact-links WordPress URL Shortener plugin is affected in versions through 3.0.7. The vulnerability impacts all installations running this plugin up to and including version 3.0.7. Affected users can identify this plugin via the CPE reference for WordPress plugins and should check their installed version against the vendor advisory at https://patchstack.com/database/Wordpress/Plugin/exact-links/vulnerability/wordpress-url-shortener-3-0-7-broken-access-control-vulnerability?_s_id=cve.

RemediationAI

Update the exact-links WordPress URL Shortener plugin to a patched version beyond 3.0.7. Users should navigate to their WordPress plugin dashboard, locate the exact-links plugin, and click 'Update' if a newer version is available. If a patched version is not yet available on WordPress.org, check the Patchstack advisory for vendor guidance and timeline. As a temporary mitigation, disable the exact-links plugin entirely until a security update is released. Additionally, audit user roles and capabilities to ensure no unintended access has been granted, and consider implementing Web Application Firewall (WAF) rules to block unauthorized access attempts to plugin functionality endpoints.