What is the CVSS score of CVE-2025-62888?

CVE-2025-62888 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.1%.

Wordpress Plugin CVE-2025-62888

MEDIUM

Missing Authorization (CWE-862)

2025-12-31 audit@patchstack.com

WordPress Authentication Bypass Wordpress Plugin

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

CVSS changed

Apr 23, 2026 - 15:43 NVD

5.4 (MEDIUM)

Analysis Generated

Apr 01, 2026 - 17:44 vuln.today

CVE Published

Dec 31, 2025 - 15:15 nvd

N/A

DescriptionCVE.org

Missing Authorization vulnerability in Marco Milesi WP Attachments wp-attachments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Attachments: from n/a through <= 5.2.

AnalysisAI

Missing authorization in Marco Milesi WP Attachments WordPress plugin through version 5.2 allows unauthenticated or low-privileged attackers to bypass access control restrictions and exploit incorrectly configured security levels to access protected attachments. The vulnerability stems from broken access control validation (CWE-862) and carries a low exploitation probability (EPSS 0.05%, 17th percentile), with no confirmed public exploit code or active exploitation documented at analysis time.

Technical ContextAI

The WP Attachments plugin for WordPress implements access control mechanisms to restrict attachment visibility based user roles and permissions. The vulnerability exists in the authorization logic that validates whether a user has sufficient privileges to access protected attachments. CWE-862 (Missing Authorization) indicates the plugin fails to properly enforce access control checks before returning protected resources, allowing bypass of the intended security model. This is a common class of vulnerability in WordPress plugins where attachment metadata or direct file access endpoints lack proper capability verification against WordPress user roles and permissions.

Affected ProductsAI

Marco Milesi WP Attachments WordPress plugin versions through and including 5.2 are affected. The plugin is available on WordPress.org and is identified by the CPE context of a WordPress plugin artifact. Patchstack has documented the vulnerability in their WordPress plugin vulnerability database at https://patchstack.com/database/Wordpress/Plugin/wp-attachments/vulnerability/wordpress-wp-attachments-plugin-5-2-broken-access-control-vulnerability.

RemediationAI

Update WP Attachments to a patched version beyond 5.2 immediately upon availability. Administrators should navigate to the WordPress dashboard, go to Plugins, and update WP Attachments to the latest available version. Until a patch is released, review and verify attachment access control settings in the plugin configuration to ensure only intended users can access protected files. The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/wp-attachments/vulnerability/wordpress-wp-attachments-plugin-5-2-broken-access-control-vulnerability provides additional remediation guidance and should be consulted for specific configuration recommendations.