What is the CVSS score of CVE-2025-49988?

CVE-2025-49988 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.1%.

Which versions of Contact Form 7 AWeber Extension are affected by CVE-2025-49988?

Organizations using Missing Authorization vulnerability in Renzo Contact Form 7 AWeber Extension should be aware of moderate risk from CVE-2025-49988, a missing authorization vulnerability rated CVSS…

How to fix or mitigate CVE-2025-49988?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Contact Form 7 AWeber Extension CVE-2025-49988

EUVD-2025-28341 MEDIUM

Missing Authorization (CWE-862)

2025-06-20 audit@patchstack.com

WordPress Authentication Bypass Wordpress Plugin

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

vuln.today AI

5.3 MEDIUM

AV:N, AC:L, PR:N, UI:N per description; impact only availability low.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 15, 2026 - 00:19 euvd

EUVD-2025-28341

Analysis Generated

Mar 15, 2026 - 00:19 vuln.today

CVE Published

Jun 20, 2025 - 15:15 nvd

MEDIUM 5.3

DescriptionCVE.org

Missing Authorization vulnerability in Renzo Contact Form 7 AWeber Extension allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Contact Form 7 AWeber Extension: from n/a through 0.1.38.

AnalysisAI

Missing authorization in Contact Form 7 AWeber Extension up to version 0.1.38 allows unauthenticated attackers to exploit incorrectly configured access controls, potentially causing limited availability impact. No public exploit or active exploitation has been identified, and the EPSS score is low (0.08%).

Technical ContextAI

The vulnerability is a Missing Authorization (CWE-862) in the WordPress plugin 'Contact Form 7 AWeber Extension', which integrates Contact Form 7 with AWeber email marketing. The plugin fails to properly enforce access control on certain functionality, allowing unauthenticated users to trigger actions that should require authorization. The CVSS vector indicates network attack vector, low complexity, no privileges, and no user interaction, but only low availability impact.

RemediationAI

Update the Contact Form 7 AWeber Extension to version 0.1.39 or later, as per the vendor advisory. No workarounds are documented; disabling the plugin until updated may be considered if availability impact is a concern.