WordPress
CVE-2025-62091
MEDIUM
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Lifecycle Timeline
3DescriptionCVE.org
Missing Authorization vulnerability in Vollstart Serial Codes Generator and Validator with WooCommerce Support serial-codes-generator-and-validator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Serial Codes Generator and Validator with WooCommerce Support: from n/a through <= 2.8.2.
AnalysisAI
Broken access control in Vollstart Serial Codes Generator and Validator with WooCommerce Support plugin through version 2.8.2 allows unauthenticated attackers to exploit misconfigured security levels and bypass authorization checks to access or manipulate serial code functionality. The vulnerability stems from missing authorization validation on security-sensitive operations, enabling attackers to perform actions without proper privilege verification. No public exploit code or active exploitation has been identified at time of analysis, though the low EPSS score (0.05%) suggests limited real-world exploitation probability despite the access control weakness.
Technical ContextAI
The vulnerability is a broken access control flaw (CWE-862: Missing Authorization) in a WordPress plugin that manages serial code generation, validation, and integration with WooCommerce. CWE-862 indicates that the application fails to properly verify that users have authorization to perform requested actions before executing privileged operations. The plugin is responsible for issuing and validating serial codes within WooCommerce e-commerce environments, making authorization controls critical to prevent unauthorized code generation, modification, or access to customer serial data. The root cause appears to be incorrectly configured access control security levels, suggesting that capability checks or permission validation functions are either absent or improperly implemented in the affected plugin code paths.
Affected ProductsAI
Vollstart Serial Codes Generator and Validator with WooCommerce Support plugin for WordPress, all versions through 2.8.2. The plugin is available on WordPress.org and is typically identified via plugin slug 'serial-codes-generator-and-validator'. No specific CPE string for WordPress plugins is consistently maintained in official databases; affected installations can be identified by the plugin name and version number in WordPress admin dashboards.
RemediationAI
Update the Serial Codes Generator and Validator with WooCommerce Support plugin to the patched version released after 2.8.2. Access the WordPress admin dashboard, navigate to Plugins, locate 'Serial Codes Generator and Validator with WooCommerce Support', and click 'Update' if available. If an update is not yet available, temporarily disable the plugin to prevent exploitation until a patched version is released by the vendor. Consult the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/serial-codes-generator-and-validator/vulnerability/wordpress-serial-codes-generator-and-validator-with-woocommerce-support-plugin-2-8-2-broken-access-control-vulnerability for confirmation of patch availability and detailed remediation guidance. Once patched, verify that user role restrictions are properly enforced by testing serial code generation and validation functions with low-privilege accounts.
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Country State City Dropdown CF7 plugin for WordPress is vulnerable to SQL Injection via the ‘cnt’ and 'sid' paramete
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today