What is the CVSS score of CVE-2025-53266?

CVE-2025-53266 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.1%.

Which versions of Cron Logger are affected by CVE-2025-53266?

Organizations using Missing Authorization vulnerability in EdwardBock Cron Logger should be aware of moderate risk from CVE-2025-53266, a missing authorization vulnerability rated CVSS 4.3.

How to fix or mitigate CVE-2025-53266?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Cron Logger CVE-2025-53266

EUVD-2025-19346 MEDIUM

Missing Authorization (CWE-862)

2025-06-27 audit@patchstack.com

WordPress Authentication Bypass Wordpress Plugin

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

vuln.today AI

4.3 MEDIUM

Requires low-privileged account, no user interaction; only availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 16, 2026 - 00:16 euvd

EUVD-2025-19346

Analysis Generated

Mar 16, 2026 - 00:16 vuln.today

CVE Published

Jun 27, 2025 - 14:15 nvd

MEDIUM 4.3

DescriptionCVE.org

Missing Authorization vulnerability in EdwardBock Cron Logger allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Cron Logger: from n/a through 1.3.0.

AnalysisAI

Low-privileged authenticated users can bypass authorization checks in the Cron Logger WordPress plugin up to version 1.3.0, leading to limited service disruption. The flaw allows attackers with subscriber-level or similar low access to cause availability impact without any interaction. No evidence of active exploitation or public exploit code exists.

Technical ContextAI

The vulnerability is a missing authorization flaw (CWE-862) in the Cron Logger WordPress plugin, which likely manages WordPress cron jobs. The CPE data indicates the affected product is the WordPress plugin cron-logger (cpe:2.3:a:edwardbock:cron_logger:*:*:*:*:*:*:*:*). The CVSS vector reveals network-based attack (AV:N) with low attack complexity (AC:L), requiring low-privileged authentication (PR:L) and no user interaction (UI:N), but impacts only availability (A:L), not confidentiality or integrity. This suggests an attacker authenticated at a minimal role can trigger a function that degrades service without gaining data or altering system state. The root cause is missing access control checks, typical of improperly implemented authorization in web applications.

RemediationAI

Update the Cron Logger plugin to a version higher than 1.3.0 once a fixed release is available. If no patch is provided, deactivate and remove the plugin until a fix is released. As a compensating control, restrict low-privileged user accounts to prevent abuse, though this may limit legitimate functionality if those users need to interact with cron logging.