What is the CVSS score of CVE-2025-49265?

CVE-2025-49265 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of WordPress are affected by CVE-2025-49265?

A missing authorization vulnerability in WP Swings Membership For WooCommerce (versions through 2.8.1) allows unauthorized users to access restricted membership functionality, potentially exposing…

How to fix or mitigate CVE-2025-49265?

Within 24 hours: Disable the WP Swings Membership For WooCommerce plugin or restrict access to membership administrative functions via network/WAF controls. Within 7 days: Audit access logs for unauthorized membership feature access and review user account activity for suspicious changes. Within 30 days: Monitor vendor for patch release; once available, test and deploy immediately. Until patched, maintain access controls via WAF/network segmentation as interim protection.

WordPress CVE-2025-49265

EUVD-2025-17540 HIGH

Missing Authorization (CWE-862)

2025-06-09 audit@patchstack.com

WordPress Authentication Bypass

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

EUVD ID Assigned

Mar 14, 2026 - 19:21 euvd

EUVD-2025-17540

Analysis Generated

Mar 14, 2026 - 19:21 vuln.today

CVE Published

Jun 09, 2025 - 16:15 nvd

HIGH 7.5

DescriptionCVE.org

Missing Authorization vulnerability in WP Swings Membership For WooCommerce allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Membership For WooCommerce: from n/a through 2.8.1.

AnalysisAI

Missing Authorization (CWE-862) vulnerability in WP Swings Membership For WooCommerce that allows unauthenticated attackers to access functionality not properly constrained by Access Control Lists (ACLs). The vulnerability affects versions up to and including 2.8.1 of this WordPress/WooCommerce plugin, enabling unauthorized users to bypass membership restrictions and potentially access premium features or sensitive membership data without valid credentials. With a CVSS score of 7.5 and a network-accessible attack vector requiring no privileges or user interaction, this represents a significant exposure risk for e-commerce sites relying on this plugin for membership management.

Technical ContextAI

The vulnerability exists in WP Swings Membership For WooCommerce (CPE: likely wp:swings_membership_for_woocommerce or similar), a WordPress plugin that extends WooCommerce functionality to provide membership management and access control. The root cause is CWE-862 (Missing Authorization), which indicates that functionality intended to be restricted by role-based access control (RBAC) or similar ACL mechanisms is accessible without proper authentication/authorization checks. This class of vulnerability typically arises when developers fail to implement capability checks (in WordPress context: current_user_can()) or nonce verification before exposing sensitive endpoints, REST API routes, or admin functions. The plugin likely implements membership tiers and gated content, but certain administrative or data-access endpoints are missing authorization middleware, allowing unauthenticated or unprivileged users to interact with protected functionality.

RemediationAI

Immediate Actions: (1) Update WP Swings Membership For WooCommerce to version 2.8.2 or later (patch version number inferred from vulnerability affecting <=2.8.1; verify with vendor); (2) If immediate patching is not possible, disable the plugin temporarily if membership features are not critical; (3) Implement Web Application Firewall (WAF) rules to block requests to known vulnerable endpoints if identified. Long-term Mitigations: (1) Ensure all WordPress plugins are kept current with automatic updates enabled where possible; (2) Implement least-privilege WordPress user roles and capabilities; (3) Use security scanning tools (e.g., Wordfence, Sucuri) to audit for similar authorization issues; (4) Monitor access logs for suspicious unauthorized API/endpoint access attempts. Vendor Contact: Check WP Swings official website or plugin repository for patch availability and installation instructions. Apply patches immediately upon availability to all affected installations.