Breeze Checkout CVE-2025-49961
MEDIUMSeverity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Network-accessible unprotected endpoint requires no privileges or interaction; impact limited to low integrity and availability with no confidentiality exposure.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionCVE.org
Missing Authorization vulnerability in Breeze Team Breeze Checkout breeze-checkout allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Breeze Checkout: from n/a through <= 1.4.0.
AnalysisAI
Missing authorization in the Breeze Checkout WordPress plugin (versions through 1.4.0) exposes restricted functionality to unauthenticated network attackers, enabling low-impact integrity and availability manipulation. The vulnerability stems from CWE-862 (Missing Authorization), where plugin endpoints fail to verify that the requesting party holds appropriate permissions before executing privileged operations. No public exploit code has been identified and EPSS probability sits at 0.05% (15th percentile), indicating low current exploitation activity despite the ease of network access implied by the CVSS vector.
Technical ContextAI
Breeze Checkout is a WordPress e-commerce plugin developed by Breeze Team, affected through version 1.4.0. CWE-862 (Missing Authorization) describes a class of flaws where software performs an operation without verifying that the actor is permitted to do so - commonly seen in WordPress plugins as unprotected AJAX handlers or REST API routes that omit capability checks (e.g., missing current_user_can() or nonce verification). The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L confirms the flaw is reachable over the network without authentication and without user interaction, with the attack surface being the plugin's own HTTP-accessible endpoints. The tag 'Authentication Bypass' corroborates that the authorization layer is absent rather than merely misconfigured. No CPE string was provided, so exact version enumeration relies on the Patchstack advisory and the NVD-reported affected range of n/a through 1.4.0.
Affected ProductsAI
The Breeze Checkout WordPress plugin by Breeze Team is affected from an unspecified early version through and including version 1.4.0. No CPE string was included in the input data, so version boundary confirmation relies solely on the NVD entry and the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/breeze-checkout/vulnerability/wordpress-breeze-checkout-plugin-1-4-0-broken-access-control-vulnerability. No other products or platforms are identified as affected.
RemediationAI
Update the Breeze Checkout plugin to a version beyond 1.4.0 as the primary remediation step. The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/breeze-checkout/vulnerability/wordpress-breeze-checkout-plugin-1-4-0-broken-access-control-vulnerability should be consulted for the confirmed patched release version, as no specific fix version number was included in the available input data - the exact patched version is not independently confirmed from this dataset. If an immediate update is not feasible, consider temporarily deactivating the Breeze Checkout plugin and using an alternative checkout mechanism to eliminate the attack surface entirely; this has the obvious trade-off of disrupting checkout functionality. WordPress site firewall rules (e.g., via Wordfence or similar WAF plugins) can be used to block unauthenticated POST requests to the affected plugin's AJAX or REST endpoints as a partial compensating control, though this requires identifying the specific endpoint paths from the vendor or Patchstack.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today