What is the CVSS score of CVE-2025-49334?

CVE-2025-49334 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Wordpress Plugin CVE-2025-49334

MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2025-12-31 audit@patchstack.com

WordPress Authentication Bypass Wordpress Plugin

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

CVSS changed

Apr 23, 2026 - 15:43 NVD

5.3 (MEDIUM)

Analysis Generated

Apr 01, 2026 - 17:44 vuln.today

CVE Published

Dec 31, 2025 - 16:15 nvd

N/A

DescriptionCVE.org

Authorization Bypass Through User-Controlled Key vulnerability in Eduardo Villão MyD Delivery myd-delivery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MyD Delivery: from n/a through <= 1.7.1.

AnalysisAI

Authorization bypass in MyD Delivery WordPress plugin through version 1.7.1 allows unauthenticated attackers to manipulate user-controlled keys to access resources without proper permission validation, exploiting misconfigured access control security levels. The vulnerability carries low exploitation probability (EPSS 0.04%) but represents a fundamental authorization flaw affecting the plugin's core access control mechanism.

Technical ContextAI

MyD Delivery is a WordPress plugin (CPE data not explicitly provided but inferred from plugin name and reference domain) that manages delivery operations. The vulnerability stems from CWE-639 (Authorization Through User-Controlled Key), which occurs when an application uses user-supplied input (such as a user ID, object ID, or session token) as the sole basis for authorization decisions without server-side validation or role-based access control enforcement. This class of vulnerability typically manifests in REST API endpoints, AJAX handlers, or direct object references where the plugin fails to verify that the authenticated user (or attacker) actually has permission to access the requested resource before returning sensitive data or executing privileged actions.

Affected ProductsAI

MyD Delivery WordPress plugin is affected in all versions from an unspecified baseline through version 1.7.1 inclusive. The plugin is hosted on WordPress.org plugin repository (patchstack.com reference indicates WordPress plugin ecosystem). No CPE string was provided in input data, but the affected software is identifiable as the MyD Delivery delivery management plugin for WordPress authored by Eduardo Villão.

RemediationAI

Update MyD Delivery plugin to the latest available version beyond 1.7.1 immediately. No specific patched version number is confirmed in the provided data; consult the plugin's WordPress.org page or the Patchstack vulnerability database reference (https://patchstack.com/database/Wordpress/Plugin/myd-delivery/) for the exact recommended version. As an interim mitigation pending patch availability, restrict plugin functionality or disable delivery-related API endpoints if they expose user-controlled authorization logic. Audit existing plugin installations for unauthorized access patterns in delivery records or user data.