What is the CVSS score of CVE-2025-30959?

CVE-2025-30959 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.1%.

WordPress CVE-2025-30959

MEDIUM

Missing Authorization (CWE-862)

2025-07-16 audit@patchstack.com

WordPress Authentication Bypass

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

CVSS changed

Apr 23, 2026 - 15:42 NVD

6.5 (MEDIUM)

Analysis Generated

Apr 01, 2026 - 17:26 vuln.today

CVE Published

Jul 16, 2025 - 12:15 nvd

N/A

DescriptionCVE.org

Missing Authorization vulnerability in WPFactory Product XML Feed Manager for WooCommerce product-xml-feeds-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product XML Feed Manager for WooCommerce: from n/a through <= 2.9.2.

AnalysisAI

Missing authorization controls in WPFactory's Product XML Feed Manager for WooCommerce through version 2.9.2 allow attackers to exploit incorrectly configured access control security levels, potentially exposing sensitive product feed data or enabling unauthorized administrative actions. The vulnerability affects all versions up to and including 2.9.2, with no publicly available exploit code identified at time of analysis, and an EPSS score of 0.07% indicating very low real-world exploitation probability despite the authorization defect.

Technical ContextAI

The vulnerability stems from CWE-862 (Missing Authorization), a fundamental access control flaw where the WordPress plugin fails to properly validate user permissions before granting access to sensitive functionality or data. This is distinct from CWE-287 (authentication bypass) as the plugin likely authenticates users but then fails to check whether those users have the appropriate role or capability to perform actions or access resources. In WordPress plugin architecture, this typically occurs when developers use action hooks or AJAX endpoints without properly calling functions like current_user_can() to verify user capabilities against required roles (e.g., manage_options, manage_woocommerce). The Product XML Feed Manager for WooCommerce generates product feeds in XML format-sensitive business data including pricing, inventory, and supplier information-making improper access controls a material risk if accessible to unauthorized users.

Affected ProductsAI

WPFactory Product XML Feed Manager for WooCommerce versions up to and including 2.9.2 are affected. This is a WordPress plugin distributed via the WordPress.org plugin repository and installed on WooCommerce-powered e-commerce sites. The vulnerability exists in all versions from the earliest release through version 2.9.2. See Patchstack vulnerability database for full advisory details: https://patchstack.com/database/Wordpress/Plugin/product-xml-feeds-for-woocommerce/vulnerability/wordpress-product-xml-feed-manager-for-woocommerce-2-9-2-broken-access-control-vulnerability?_s_id=cve

RemediationAI

Update WPFactory Product XML Feed Manager for WooCommerce to a version newer than 2.9.2. Consult the official Patchstack advisory and the plugin's GitHub or WordPress.org repository for the specific patched version number and release date. In the interim, WordPress administrators should audit user roles and capabilities assigned to subscribers and customers, ensuring that product feed generation or export functionality is restricted to shop managers and administrators only. Review custom code or additional plugins that may integrate with the feed manager's hooks or AJAX endpoints to ensure they enforce capability checks. If the plugin's feed endpoints are exposed via public URLs, consider adding additional authentication or IP allowlist restrictions at the web server or firewall level pending availability of an official patch.