What is the CVSS score of CVE-2025-62153?

CVE-2025-62153 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

Quick Interest Slider CVE-2025-62153

Q: Which versions of Quick Interest Slider are affected by CVE-2025-62153?

Missing authorization in the Quick Interest Slider WordPress plugin (≤ 3.1.7) allows unauthenticated attackers to modify slider configuration data over the network.

MEDIUM

Missing Authorization (CWE-862)

2025-12-09 audit@patchstack.com

WordPress Authentication Bypass Wordpress Plugin

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.3 MEDIUM

Network-accessible endpoint, no privileges required, low integrity impact only.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 17:49 vuln.today

DescriptionCVE.org

Missing Authorization vulnerability in Graham Quick Interest Slider quick-interest-slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quick Interest Slider: from n/a through <= 3.1.7.

AnalysisAI

Missing authorization in the Quick Interest Slider WordPress plugin (≤ 3.1.7) allows unauthenticated attackers to modify slider configuration data over the network. No active exploitation or public exploit code has been identified, and EPSS indicates a low exploitation probability (0.07%).

Technical ContextAI

The vulnerability exists in a WordPress plugin (slug: quick-interest-slider) written in PHP. It stems from a missing authorization check (CWE-862) on an exposed REST or AJAX endpoint, meaning the plugin does not verify user capabilities before processing requests. This allows unauthenticated access to functionality that should be restricted to administrators or editors, consistent with the plugin's typical role in displaying customizable interest rate sliders on a site.

Affected ProductsAI

Quick Interest Slider WordPress plugin versions from n/a through and including 3.1.7 are affected. No CPE is provided in the data, but the vulnerability is tracked through Patchstack at https://patchstack.com/database/WordPress/Plugin/quick-interest-slider/vulnerability/wordpress-quick-interest-slider-plugin-3-1-5-broken-access-control-vulnerability?_s_id=cve (the advisory references version 3.1.5 but the description bounds include up to 3.1.7). A patched version is not explicitly stated in the input, so users should monitor the plugin's official WordPress.org repository for an update beyond 3.1.7.

RemediationAI

Update to a version newer than 3.1.7 if one becomes available, as the vendor advisory does not list a specific fix version. As an interim measure, restrict network access to the vulnerable endpoint (e.g., via a web application firewall rule blocking direct access to plugin AJAX actions) or, if the slider functionality is non-critical, temporarily disable the plugin. Monitor the Patchstack advisory for remediation details. Users should also review any custom access control configurations that might exacerbate the issue, though the vulnerability is exploitable even on default installations.