What is the CVSS score of CVE-2025-30624?

CVE-2025-30624 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of WordLift are affected by CVE-2025-30624?

Organizations using Missing Authorization vulnerability in WordLift WordLift should be aware of moderate risk from CVE-2025-30624, a missing authorization vulnerability rated CVSS 4.3.

How to fix or mitigate CVE-2025-30624?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

WordLift CVE-2025-30624

EUVD-2025-17190 MEDIUM

Missing Authorization (CWE-862)

2025-06-06 audit@patchstack.com

WordPress Authentication Bypass Wordpress Plugin

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

PR:L due to authenticated requirement; low integrity impact only.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 18:10 euvd

EUVD-2025-17190

Analysis Generated

Mar 14, 2026 - 18:10 vuln.today

CVE Published

Jun 06, 2025 - 13:15 nvd

MEDIUM 4.3

DescriptionCVE.org

Missing Authorization vulnerability in WordLift WordLift allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WordLift: from n/a through 3.54.4.

AnalysisAI

Missing authorization in WordLift plugin for WordPress allows authenticated attackers with low privileges to exploit incorrectly configured access controls, potentially modifying data. The vulnerability affects versions up to 3.54.4 and has a low EPSS score (0.06%), with no public exploit or active exploitation confirmed.

Technical ContextAI

The vulnerability is a Missing Authorization (CWE-862) in the WordLift WordPress plugin, which provides AI-powered content enrichment. The issue arises from insufficient access control checks, allowing users with low privileges to perform actions that should require higher authorization. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, and unchanged scope, with low integrity impact and no confidentiality or availability impact.

RemediationAI

Update WordLift plugin to version 3.54.5 or later. The patch is available from the vendor. No workarounds are documented; however, restricting low-privileged user roles or disabling the plugin temporarily could mitigate risk until patching is complete.