What is the CVSS score of CVE-2025-52757?

CVE-2025-52757 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2025-52757

MEDIUM

Missing Authorization (CWE-862)

2025-10-22 audit@patchstack.com

WordPress Authentication Bypass

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

CVSS changed

Apr 23, 2026 - 15:42 NVD

6.3 (MEDIUM) 6.5 (MEDIUM)

Analysis Generated

Apr 01, 2026 - 15:22 vuln.today

CVE Published

Oct 22, 2025 - 15:15 nvd

MEDIUM 6.3

DescriptionCVE.org

Missing Authorization vulnerability in FantasticPlugins SUMO Memberships for WooCommerce sumomemberships allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SUMO Memberships for WooCommerce: from n/a through < 7.8.0.

AnalysisAI

Unauthenticated attackers can bypass access controls in SUMO Memberships for WooCommerce versions below 7.8.0 to perform unauthorized actions including content modification and deletion through incorrectly configured membership level enforcement. The vulnerability requires user interaction (UI:R) but affects confidentiality, integrity, and availability of protected content. No public exploit code or active exploitation has been confirmed.

Technical ContextAI

SUMO Memberships for WooCommerce is a WordPress plugin that manages membership-based access control for WooCommerce stores. The vulnerability stems from CWE-862 (Missing Authorization), indicating the plugin fails to properly validate whether users possess required membership levels before executing sensitive operations. The plugin's access control logic does not adequately check authorization credentials on sensitive endpoints, allowing unauthenticated or low-privilege users to interact with protected resources through crafted requests. This is a classic authorization bypass in WordPress plugin architecture where capability checks are either absent or improperly implemented for certain administrative or membership-restricted functions.

Affected ProductsAI

FantasticPlugins SUMO Memberships for WooCommerce plugin versions from unspecified baseline through 7.7.9 are affected. The vulnerable plugin is commonly installed on WooCommerce-powered WordPress sites. Vendor advisory and vulnerability details are available on Patchstack's vulnerability database at https://patchstack.com/database/Wordpress/Plugin/sumomemberships/vulnerability/wordpress-sumo-memberships-for-woocommerce-plugin-7-6-0-arbitrary-content-deletion-vulnerability.

RemediationAI

Update SUMO Memberships for WooCommerce to version 7.8.0 or later immediately through the WordPress plugin update interface. Site administrators should navigate to Plugins > Installed Plugins, locate SUMO Memberships for WooCommerce, and click Update if available. No workarounds are documented; patching is the definitive remediation. After updating, verify that membership access restrictions are functioning correctly by testing content visibility for different membership levels. Refer to the Patchstack advisory for additional context.