What is the CVSS score of CVE-2025-62754?

CVE-2025-62754 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Wordpress Plugin are affected by CVE-2025-62754?

A critical authorization flaw in the bKash payment gateway plugin for WooCommerce (CVE-2025-62754, CVSS 9.1) allows unauthenticated attackers to bypass access controls and potentially manipulate…

How to fix or mitigate CVE-2025-62754?

Within 24 hours: Disable the woo-payment-bkash plugin immediately and switch to an alternative payment processor; notify all stakeholders and customers of the temporary payment processing change. Within 7 days: Conduct forensic audit of transaction logs for suspicious activity since plugin deployment; engage bKash vendor for patch timeline and security updates. Within 30 days: Implement enhanced payment gateway monitoring, deploy WAF rules to restrict unauthorized payment API access, and establish vendor security review process before deploying payment-critical plugins.

Wordpress Plugin CVE-2025-62754

MEDIUM

Missing Authorization (CWE-862)

2026-01-22 audit@patchstack.com

WordPress Authentication Bypass Wordpress Plugin

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Severity Changed

Apr 23, 2026 - 15:43 NVD

CRITICAL MEDIUM

CVSS changed

Apr 23, 2026 - 15:43 NVD

9.1 (CRITICAL) 5.3 (MEDIUM)

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Jan 22, 2026 - 17:15 nvd

CRITICAL 9.1

DescriptionCVE.org

Missing Authorization vulnerability in Kapil Paul Payment Gateway bKash for WC woo-payment-bkash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Payment Gateway bKash for WC: from n/a through <= 3.1.0.

AnalysisAI

Payment Gateway bKash for WooCommerce has a missing authorization vulnerability allowing attackers to exploit incorrect access controls for privilege escalation.

Technical ContextAI

The woo-payment-bkash plugin has a CWE-862 missing authorization vulnerability that allows unauthenticated or low-privileged users to access administrative functions through improperly protected endpoints.