What is the CVSS score of CVE-2025-49950?

CVE-2025-49950 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Billingo WordPress Plugin are affected by CVE-2025-49950?

The Billingo WordPress plugin versions 4.3.0 and earlier contains a privilege escalation vulnerability (CVE-2025-49950) affecting sites using high-privilege user accounts.

How to fix or mitigate CVE-2025-49950?

Within 24 hours: Identify all WordPress instances running Billingo plugin ≤4.3.0 using automated asset discovery; document all users with administrative access. Within 7 days: Disable or remove the Billingo plugin pending vendor patch; audit access logs for suspicious API activity from high-privilege accounts; restrict API endpoint access via web application firewall if the plugin cannot be immediately removed. Within 30 days: Monitor Billingo plugin security advisories for patched version release; implement principle of least privilege controls limiting administrator account usage; conduct penetration test of affected WordPress environment post-remediation.

Billingo WordPress Plugin CVE-2025-49950

HIGH

Missing Authorization (CWE-862)

2025-10-22 audit@patchstack.com

Privilege Escalation Authentication Bypass

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 24, 2026 - 01:15 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

CVSS changed

Apr 23, 2026 - 15:42 NVD

7.3 (HIGH) 7.2 (HIGH)

Analysis Generated

Apr 01, 2026 - 15:22 vuln.today

CVE Published

Oct 22, 2025 - 15:15 nvd

HIGH 7.3

DescriptionCVE.org

Missing Authorization vulnerability in billingo Official Integration for Billingo billingo allows Privilege Escalation.This issue affects Official Integration for Billingo: from n/a through <= 4.3.0.

AnalysisAI

Missing authorization in the Billingo WordPress plugin (versions ≤4.3.0) enables authenticated high-privilege users to escalate privileges through unprotected API endpoints. CVSS 7.2 indicates network-accessible exploitation requiring high-privilege authentication with high impact across confidentiality, integrity, and availability. EPSS score of 0.06% (18th percentile) suggests low observed exploitation probability. No CISA KEV listing or public exploit identified at time of analysis, though Patchstack vulnerability database confirms the vulnerability class as both authentication bypass and privilege escalation.

Technical ContextAI

This vulnerability stems from CWE-862 (Missing Authorization), a common flaw in WordPress plugins where developers fail to implement proper permission checks on administrative or API functions. The Billingo plugin integrates WordPress e-commerce platforms with Billingo invoicing services, likely exposing invoice management, customer data, and financial transaction endpoints. The missing authorization check allows authenticated users with lower privileges to invoke privileged functions without proper capability validation using WordPress's current_user_can() or similar authorization gates. The CVSS vector PR:H indicates exploitation requires high-privilege credentials, suggesting this affects scenarios where WordPress sites have multiple user roles (e.g., editor, shop manager) and the vulnerability allows escalation to administrator-level access or cross-account data manipulation.

Affected ProductsAI

WordPress Official Integration for Billingo plugin versions from earliest release through 4.3.0 inclusive. The vulnerability report from Patchstack (audit@patchstack.com) identifies version 4.2.5 specifically in the reference URL, suggesting the flaw persisted across multiple minor releases. Affected deployments are WordPress installations with the Billingo plugin active and configured for invoice generation or billing integration, particularly those with multiple user roles beyond administrator. Vendor advisory available at https://patchstack.com/database/Wordpress/Plugin/billingo/vulnerability/wordpress-official-integration-for-billingo-plugin-4-2-5-privilege-escalation-vulnerability.

RemediationAI

Upgrade to Billingo WordPress plugin version 4.3.1 or later if available (version number inferred as next stable release; verify exact patched version from vendor advisory at https://patchstack.com/database/Wordpress/Plugin/billingo/). Until patching is possible, implement these compensating controls with noted trade-offs: (1) Restrict WordPress user roles to only trusted administrators-eliminate editor and shop manager roles if business processes allow, though this reduces operational flexibility for multi-user teams. (2) Implement WordPress security plugins with endpoint monitoring to detect unusual invoice API calls from non-administrator accounts (adds overhead, requires tuning to avoid false positives). (3) Enable comprehensive WordPress audit logging for all Billingo plugin actions with real-time alerting on privilege escalation indicators-this provides detection, not prevention. (4) Segment WordPress instance network access through WAF rules limiting admin endpoint access to known IP ranges-reduces attack surface but breaks legitimate remote access. Note that workarounds provide only partial risk reduction; patching remains the primary remediation.