What is the CVSS score of CVE-2025-62740?

CVE-2025-62740 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

PHP CVE-2025-62740

MEDIUM

Missing Authorization (CWE-862)

2025-12-09 audit@patchstack.com

WordPress PHP Authentication Bypass

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 01, 2026 - 15:22 vuln.today

CVE Published

Dec 09, 2025 - 16:18 nvd

MEDIUM 5.3

DescriptionCVE.org

Missing Authorization vulnerability in Mario Peshev WP-CRM System wp-crm-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP-CRM System: from n/a through <= 3.4.6.

AnalysisAI

Missing authorization controls in Mario Peshev WP-CRM System plugin up to version 3.4.6 allow unauthenticated remote attackers to modify data through incorrectly configured access control security levels. The CVSS 5.3 score reflects low integrity impact with no confidentiality or availability consequences, but the vulnerability exposes the plugin to unauthorized data manipulation attacks without authentication.

Technical ContextAI

The vulnerability stems from CWE-862 (Missing Authorization), a failure to implement proper access control checks before permitting sensitive operations. In the WordPress plugin ecosystem, this typically manifests when plugin functions that modify database records (posts, users, custom data) lack proper capability checks or nonce verification. The WP-CRM System plugin appears to have inadequately implemented WordPress security standards (check_admin_referer, current_user_can) when handling access to CRM-related operations, allowing the access control security levels to be bypassed. The vulnerability affects the Mario Peshev WP-CRM System plugin identified via CPE references on the Patchstack vulnerability database.

Affected ProductsAI

Mario Peshev WP-CRM System WordPress plugin versions from inception through 3.4.6 are affected. The vulnerability is documented in the Patchstack vulnerability database with references to version 3.4.5 analysis, indicating that at minimum versions 3.4.5 and 3.4.6 are confirmed vulnerable. Site administrators running any version of the WP-CRM System plugin should verify their installed version and take remediation steps. The plugin is distributed through the WordPress.org plugin repository and third-party WordPress hosting environments.

RemediationAI

Update the WP-CRM System plugin to the patched version (specific fixed version number not stated in available advisory data; check Patchstack and WordPress.org plugin repository for the latest release). Immediately access the WordPress admin dashboard, navigate to Plugins, search for 'WP-CRM System,' and click 'Update Now' if available. If no patched version is yet released, disable the plugin temporarily until a fix is available; alternatively, contact the plugin author (Mario Peshev) or monitor the Patchstack database entry at https://patchstack.com/database/Wordpress/Plugin/wp-crm-system/vulnerability/wordpress-wp-crm-system-plugin-3-4-5-broken-access-control-vulnerability for patch release notifications. Ensure WordPress core and all other plugins are kept updated to reduce attack surface.