CVE-2025-52757

MEDIUM

2025-10-22 [email protected]

WordPress PHP Authentication Bypass

6.3

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Apr 01, 2026 - 15:22 vuln.today

CVE Published

Oct 22, 2025 - 15:15 nvd

MEDIUM 6.3

DescriptionNVD

Missing Authorization vulnerability in FantasticPlugins SUMO Memberships for WooCommerce sumomemberships allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SUMO Memberships for WooCommerce: from n/a through < 7.8.0.

AnalysisAI

Unauthenticated attackers can bypass access controls in SUMO Memberships for WooCommerce versions below 7.8.0 to perform unauthorized actions including content modification and deletion through incorrectly configured membership level enforcement. The vulnerability requires user interaction (UI:R) but affects confidentiality, integrity, and availability of protected content. No public exploit code or active exploitation has been confirmed.

Technical ContextAI

SUMO Memberships for WooCommerce is a WordPress plugin that manages membership-based access control for WooCommerce stores. The vulnerability stems from CWE-862 (Missing Authorization), indicating the plugin fails to properly validate whether users possess required membership levels before executing sensitive operations. The plugin's access control logic does not adequately check authorization credentials on sensitive endpoints, allowing unauthenticated or low-privilege users to interact with protected resources through crafted requests. This is a classic authorization bypass in WordPress plugin architecture where capability checks are either absent or improperly implemented for certain administrative or membership-restricted functions.

Affected ProductsAI

FantasticPlugins SUMO Memberships for WooCommerce plugin versions from unspecified baseline through 7.7.9 are affected. The vulnerable plugin is commonly installed on WooCommerce-powered WordPress sites. Vendor advisory and vulnerability details are available on Patchstack's vulnerability database at https://patchstack.com/database/Wordpress/Plugin/sumomemberships/vulnerability/wordpress-sumo-memberships-for-woocommerce-plugin-7-6-0-arbitrary-content-deletion-vulnerability.

RemediationAI

Update SUMO Memberships for WooCommerce to version 7.8.0 or later immediately through the WordPress plugin update interface. Site administrators should navigate to Plugins > Installed Plugins, locate SUMO Memberships for WooCommerce, and click Update if available. No workarounds are documented; patching is the definitive remediation. After updating, verify that membership access restrictions are functioning correctly by testing content visibility for different membership levels. Refer to the Patchstack advisory for additional context.

CVE-2025-52757 vulnerability details – vuln.today

Back