What is the CVSS score of CVE-2025-62098?

CVE-2025-62098 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.1%.

Wordpress Plugin CVE-2025-62098

MEDIUM

Missing Authorization (CWE-862)

2025-12-31 audit@patchstack.com

WordPress Authentication Bypass Wordpress Plugin

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

CVSS changed

Apr 23, 2026 - 15:43 NVD

5.4 (MEDIUM)

Analysis Generated

Apr 01, 2026 - 17:44 vuln.today

CVE Published

Dec 31, 2025 - 15:15 nvd

N/A

DescriptionCVE.org

Missing Authorization vulnerability in totalsoft Portfolio Gallery gallery-portfolio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Portfolio Gallery: from n/a through <= 1.4.8.

AnalysisAI

Missing authorization controls in totalsoft Portfolio Gallery WordPress plugin versions through 1.4.8 allow unauthenticated attackers to exploit incorrectly configured access control security levels, potentially exposing sensitive gallery content and administrative functionality to unauthorized access. The vulnerability stems from broken access control mechanisms rather than authentication bypass, meaning authenticated users may also access resources beyond their privilege level. With an EPSS score of 0.05% (17th percentile) and no CVSS severity data, real-world exploitation appears limited despite the theoretical exposure.

Technical ContextAI

The vulnerability is classified under CWE-862 (Missing Authorization), which indicates the application fails to properly enforce access control checks before allowing users to perform sensitive operations or access restricted resources. In the context of a WordPress gallery plugin, this typically manifests in insufficient capability checks on gallery management endpoints, REST API calls, or file access operations. The Portfolio Gallery plugin likely implements gallery visibility or access tiers (public, private, members-only) that are not properly validated server-side, allowing the plugin to trust client-side controls or session data without verifying the user's actual role (subscriber, contributor, editor, administrator) against the requested resource's access policy.

Affected ProductsAI

totalsoft Portfolio Gallery WordPress plugin versions 1.4.8 and earlier are affected. The plugin is distributed via the WordPress.org plugin repository. Affected installations include any WordPress site running the gallery-portfolio plugin with version numbering from initial release through 1.4.8 (exact initial version not specified in available data).

RemediationAI

Update totalsoft Portfolio Gallery to version 1.4.9 or later, which addresses the missing authorization controls. Site administrators should access the WordPress admin dashboard, navigate to Plugins > Installed Plugins, locate Gallery Portfolio, and click Update if available, or deactivate and remove the plugin if no patched version is applicable to their deployment. For organizations unable to immediately patch, implement web application firewall (WAF) rules to restrict access to gallery management endpoints to authenticated administrative users only, and audit existing gallery visibility settings to ensure sensitive galleries are not unintentionally exposed. Refer to the Patchstack database advisory at https://patchstack.com/database/Wordpress/Plugin/gallery-portfolio/vulnerability/wordpress-portfolio-gallery-plugin-1-4-8-broken-access-control-vulnerability for confirmation of patch availability and detailed mitigation guidance.