CVE-2025-62086

MEDIUM

Missing Authorization (CWE-862)

2025-12-09 audit@patchstack.com

Authentication Bypass

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Apr 01, 2026 - 15:22 vuln.today

CVE Published

Dec 09, 2025 - 16:18 nvd

MEDIUM 5.4

DescriptionCVE.org

Missing Authorization vulnerability in akazanstev Яндекс Доставка (Boxberry) boxberry allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Яндекс Доставка (Boxberry): from n/a through <= 2.34.

AnalysisAI

Missing authorization in Яндекс Доставка (Boxberry) WordPress plugin version 2.34 and earlier allows authenticated users to access or modify resources they should not be permitted to via incorrectly configured access control. An attacker with valid credentials can exploit broken access control mechanisms to view or modify sensitive data without proper privilege validation, though the CVSS 5.4 score reflects limited direct impact (confidentiality and integrity), and the 0.04% EPSS score indicates low real-world exploitation probability.

Technical ContextAI

This vulnerability stems from CWE-862 (Missing Authorization), a fundamental access control failure in the Boxberry delivery integration plugin for WordPress. The plugin fails to properly validate user roles and permissions before granting access to sensitive functions or data endpoints. Specifically, the incorrectly configured access control security levels allow authenticated users (PR:L in the CVSS vector) to bypass intended authorization checks. The vulnerability affects the WordPress plugin specifically (CPE would be wp-plugin context for boxberry), which integrates with Яндекс Доставка (Yandex Delivery) services. The root cause is insufficient privilege checking on protected actions, likely in AJAX handlers, admin endpoints, or REST API calls that should enforce stricter role-based access control.

Affected ProductsAI

Яндекс Доставка (Boxberry) WordPress plugin version 2.34 and all earlier versions are affected. The plugin integrates delivery services from Yandex into WordPress sites. The vulnerability is tracked in the Patchstack vulnerability database at https://patchstack.com/database/Wordpress/Plugin/boxberry/vulnerability/wordpress-yandeks-dostavka-boxberry-plugin-2-32-broken-access-control-vulnerability, which references version 2.32 in the URL, though the official advisory scope extends through version 2.34.

RemediationAI

Upgrade Яндекс Доставка (Boxberry) plugin to version 2.35 or later, which addresses the missing authorization issue. This fix restores proper role-based access control and validates user permissions before granting access to sensitive operations. Site administrators should navigate to WordPress Dashboard > Plugins > Installed Plugins, locate Boxberry, and update to the latest available version. Consult the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/boxberry/vulnerability/wordpress-yandeks-dostavka-boxberry-plugin-2-32-broken-access-control-vulnerability) for confirmation of patch availability and any interim recommendations. No official workarounds are documented; patching is the primary remediation path.