What is the CVSS score of CVE-2025-49864?

CVE-2025-49864 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of AFS Analytics are affected by CVE-2025-49864?

Organizations using Missing Authorization vulnerability in AFS Analytics AFS Analytics should be aware of moderate risk from CVE-2025-49864, a missing authorization vulnerability rated CVSS 5.3.

How to fix or mitigate CVE-2025-49864?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

AFS Analytics CVE-2025-49864

EUVD-2025-28323 MEDIUM

Missing Authorization (CWE-862)

2025-06-17 audit@patchstack.com

WordPress Authentication Bypass Wordpress Plugin

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.3 MEDIUM

Network attack, low complexity, no privileges, no user interaction, low integrity impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 22:15 euvd

EUVD-2025-28323

Analysis Generated

Mar 14, 2026 - 22:15 vuln.today

CVE Published

Jun 17, 2025 - 15:15 nvd

MEDIUM 5.3

DescriptionCVE.org

Missing Authorization vulnerability in AFS Analytics AFS Analytics allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects AFS Analytics: from n/a through 4.21.

AnalysisAI

Missing authorization in AFS Analytics WordPress plugin allows unauthenticated attackers to access functionality not properly constrained by ACLs. This affects versions through 4.21 and can lead to unauthorized modification of analytics data. No public exploit or active exploitation has been identified.

Technical ContextAI

The vulnerability is a missing authorization check (CWE-862) in the AFS Analytics plugin for WordPress. The plugin likely exposes AJAX actions or REST endpoints that should require authentication but do not. CPE data indicates the product is 'addfreestats' for WordPress. The CVSS vector shows network attack vector, low complexity, no privileges, and no user interaction, but only low integrity impact, suggesting the attacker can modify non-sensitive data.

RemediationAI

Update to the latest version of AFS Analytics plugin beyond 4.21. The vendor has not released a specific patched version in the available data, but users should check the WordPress plugin repository for updates. As a workaround, restrict access to the plugin's functionality via web application firewall rules or disable the plugin if not essential.