CVE-2025-62086
MEDIUMCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Lifecycle Timeline
2Description
Missing Authorization vulnerability in akazanstev Яндекс Доставка (Boxberry) boxberry allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Яндекс Доставка (Boxberry): from n/a through <= 2.34.
Analysis
Missing authorization in Яндекс Доставка (Boxberry) WordPress plugin version 2.34 and earlier allows authenticated users to access or modify resources they should not be permitted to via incorrectly configured access control. An attacker with valid credentials can exploit broken access control mechanisms to view or modify sensitive data without proper privilege validation, though the CVSS 5.4 score reflects limited direct impact (confidentiality and integrity), and the 0.04% EPSS score indicates low real-world exploitation probability.
Technical Context
This vulnerability stems from CWE-862 (Missing Authorization), a fundamental access control failure in the Boxberry delivery integration plugin for WordPress. The plugin fails to properly validate user roles and permissions before granting access to sensitive functions or data endpoints. Specifically, the incorrectly configured access control security levels allow authenticated users (PR:L in the CVSS vector) to bypass intended authorization checks. The vulnerability affects the WordPress plugin specifically (CPE would be wp-plugin context for boxberry), which integrates with Яндекс Доставка (Yandex Delivery) services. The root cause is insufficient privilege checking on protected actions, likely in AJAX handlers, admin endpoints, or REST API calls that should enforce stricter role-based access control.
Affected Products
Яндекс Доставка (Boxberry) WordPress plugin version 2.34 and all earlier versions are affected. The plugin integrates delivery services from Yandex into WordPress sites. The vulnerability is tracked in the Patchstack vulnerability database at https://patchstack.com/database/Wordpress/Plugin/boxberry/vulnerability/wordpress-yandeks-dostavka-boxberry-plugin-2-32-broken-access-control-vulnerability, which references version 2.32 in the URL, though the official advisory scope extends through version 2.34.
Remediation
Upgrade Яндекс Доставка (Boxberry) plugin to version 2.35 or later, which addresses the missing authorization issue. This fix restores proper role-based access control and validates user permissions before granting access to sensitive operations. Site administrators should navigate to WordPress Dashboard > Plugins > Installed Plugins, locate Boxberry, and update to the latest available version. Consult the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/boxberry/vulnerability/wordpress-yandeks-dostavka-boxberry-plugin-2-32-broken-access-control-vulnerability) for confirmation of patch availability and any interim recommendations. No official workarounds are documented; patching is the primary remediation path.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today