What is the CVSS score of CVE-2025-49319?

CVE-2025-49319 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.1%.

WordPress CVE-2025-49319

MEDIUM

Missing Authorization (CWE-862)

2025-07-16 audit@patchstack.com

WordPress Authentication Bypass

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

CVSS changed

Apr 23, 2026 - 15:42 NVD

6.5 (MEDIUM)

Analysis Generated

Apr 01, 2026 - 17:43 vuln.today

CVE Published

Jul 16, 2025 - 12:15 nvd

N/A

DescriptionCVE.org

Missing Authorization vulnerability in WPFactory Wishlist for WooCommerce wish-list-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wishlist for WooCommerce: from n/a through <= 3.2.3.

AnalysisAI

Missing authorization in WPFactory Wishlist for WooCommerce through version 3.2.3 allows unauthenticated attackers to exploit incorrectly configured access controls to perform unauthorized actions on wishlists. The vulnerability stems from broken access control mechanisms (CWE-862) that fail to properly validate user permissions before granting access to sensitive wish-list functionality. With an EPSS score of 0.07% (22nd percentile), real-world exploitation likelihood is currently low, but the issue affects a popular WooCommerce plugin used across numerous e-commerce sites.

Technical ContextAI

WPFactory Wishlist for WooCommerce is a WordPress plugin (CPE context: WordPress plugins extending WooCommerce functionality) that manages customer wish lists in e-commerce environments. The vulnerability involves CWE-862 (Missing Authorization), which describes scenarios where an application fails to perform proper authorization checks before allowing access to protected resources or operations. In WordPress plugin architecture, this typically manifests as missing or insufficient checks on capability functions (is_user_logged_in(), current_user_can()) or REST API endpoints lacking proper permission callbacks. The plugin's access control layer does not adequately validate whether the requesting user has legitimate permission to view, modify, or interact with wish-list data belonging to other users or accounts.

Affected ProductsAI

Wishlist for WooCommerce by WPFactory is affected in all versions from the beginning through and including version 3.2.3. The plugin extends WooCommerce functionality within WordPress environments. Affected users can identify their version through the WordPress admin plugin dashboard (Plugins > Installed Plugins). Patchstack documentation references this vulnerability for the plugin family wish-list-for-woocommerce.

RemediationAI

Update Wishlist for WooCommerce to version 3.2.4 or later, which contains the authorization fix. Users should navigate to WordPress admin > Plugins > Installed Plugins, locate Wishlist for WooCommerce, and click "Update now" if available, or manually download the patched version from the WordPress plugin repository. If an immediate update is not feasible, disable the plugin temporarily to eliminate exposure surface. Verify through WooCommerce settings and wish-list functionality that the update has resolved the authorization checks. Consult the Patchstack vulnerability database (https://patchstack.com/database/Wordpress/Plugin/wish-list-for-woocommerce/) for vendor advisory details and confirmation of the patched version availability.