What is the CVSS score of CVE-2025-62129?

CVE-2025-62129 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Wordpress Plugin CVE-2025-62129

MEDIUM

Missing Authorization (CWE-862)

2025-12-31 audit@patchstack.com

WordPress Authentication Bypass Wordpress Plugin

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

CVSS changed

Apr 23, 2026 - 15:43 NVD

5.3 (MEDIUM)

Analysis Generated

Apr 01, 2026 - 17:44 vuln.today

CVE Published

Dec 31, 2025 - 16:15 nvd

N/A

DescriptionCVE.org

Missing Authorization vulnerability in Magnigenie RestroPress restropress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RestroPress: from n/a through <= 3.2.7.

AnalysisAI

Missing authorization controls in RestroPress WordPress plugin versions through 3.2.7 allow unauthenticated attackers to bypass access restrictions and access functionality intended to be restricted by security-configured access levels. The vulnerability stems from improper validation of user permissions, enabling attackers to exploit incorrectly configured access control mechanisms. No public exploit code or active exploitation has been confirmed, though the low EPSS score (0.04%) suggests minimal real-world exploitation likelihood despite the authorization bypass nature.

Technical ContextAI

RestroPress is a WordPress restaurant management plugin that implements access control logic to restrict certain administrative or user-specific functionality based on user roles and permissions. CWE-862 (Missing Authorization) indicates the plugin fails to properly verify that a user has permission to perform requested actions before granting access. This commonly occurs when authorization checks are omitted from sensitive endpoints, when access control logic is bypassable through parameter manipulation, or when privilege levels are not properly enforced. The vulnerability affects the plugin's core access control mechanisms rather than a specific library or protocol.

Affected ProductsAI

Magnigenie RestroPress WordPress plugin versions from an unspecified baseline through version 3.2.7. The vulnerability is tracked in the Patchstack database for the RestroPress plugin (CPE data not provided in available references). The advisory reference indicates version 3.2.4 was identified in vulnerability research, with the published range extending through 3.2.7.

RemediationAI

Update RestroPress to a patched version newer than 3.2.7 immediately. Consult the Patchstack vulnerability database (https://patchstack.com/database/Wordpress/Plugin/restropress/vulnerability/wordpress-restropress-plugin-3-2-4-2-broken-access-control-vulnerability?_s_id=cve) for the specific fixed version number and installation instructions. As an interim measure, restrict access to the RestroPress plugin through web server rules or WordPress user role configuration if an immediate update is not feasible, though this does not address the underlying authorization bypass.