What is the CVSS score of CVE-2025-62918?

CVE-2025-62918 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Wordpress Plugin are affected by CVE-2025-62918?

CVE-2025-62918 is a broken access control vulnerability in IgnitionDeck WordPress plugin (versions ≤2.0.15) that allows authenticated users to escalate privileges and perform unauthorized…

How to fix or mitigate CVE-2025-62918?

Within 24 hours: Identify all WordPress instances running IgnitionDeck plugin and document current versions via admin dashboard or WP CLI. Within 7 days: Either deactivate and uninstall IgnitionDeck ≤2.0.15 if not business-critical, or restrict user access to the plugin's admin functions through role-based access controls (limit to administrator role only). Within 30 days: Monitor IgnitionDeck GitHub/vendor advisory channels for patch release to version >2.0.15; apply immediately upon availability. Implement WordPress user audit logging for all authenticated actions during interim period.

Wordpress Plugin CVE-2025-62918

MEDIUM

Missing Authorization (CWE-862)

2025-10-27 audit@patchstack.com

WordPress Authentication Bypass Wordpress Plugin

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Severity Changed

Apr 23, 2026 - 15:43 NVD

HIGH MEDIUM

CVSS changed

Apr 23, 2026 - 15:43 NVD

8.8 (HIGH) 5.4 (MEDIUM)

Analysis Generated

Apr 01, 2026 - 15:22 vuln.today

CVE Published

Oct 27, 2025 - 02:15 nvd

HIGH 8.8

DescriptionCVE.org

Missing Authorization vulnerability in ignitionwp IgnitionDeck ignitiondeck allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects IgnitionDeck: from n/a through <= 2.0.15.

AnalysisAI

Broken access control in IgnitionDeck WordPress plugin (versions ≤2.0.15) enables authenticated users to bypass authorization checks and perform unauthorized actions with elevated privileges. The vulnerability requires low-privilege authentication but has low attack complexity (CVSS 8.8, AV:N/AC:L/PR:L), allowing compromise of confidentiality, integrity, and availability. EPSS probability is low (0.05%, 15th percentile), and no public exploit is identified at time of analysis, suggesting limited active targeting despite the high severity rating.

Technical ContextAI

IgnitionDeck is a WordPress crowdfunding platform plugin. This vulnerability stems from CWE-862 (Missing Authorization), a common web application flaw where security checks are absent or improperly implemented on critical functions. The plugin fails to validate whether authenticated users possess appropriate permissions before executing sensitive operations. In WordPress context, this typically manifests as missing capability checks (e.g., current_user_can()) on AJAX handlers, REST API endpoints, or admin functions. The misconfigured access control allows low-privilege users (subscriber, contributor roles) to invoke functionality intended for administrators or specific authorized roles, effectively escalating their privileges within the application scope.

Affected ProductsAI

The vulnerability affects IgnitionDeck, a WordPress plugin developed by ignitionwp for crowdfunding and fundraising campaigns. All versions through 2.0.15 are confirmed vulnerable. The issue was reported through Patchstack's security research team (audit@patchstack.com), which maintains vulnerability intelligence for WordPress ecosystem plugins. Organizations can identify affected installations by checking their WordPress plugin version against the ≤2.0.15 threshold. The vendor advisory and technical details are available at https://patchstack.com/database/Wordpress/Plugin/ignitiondeck/vulnerability/wordpress-ignitiondeck-plugin-2-0-10-broken-access-control-vulnerability.

RemediationAI

Upgrade IgnitionDeck to version 2.0.16 or later, which addresses the missing authorization checks. Site administrators should update through the WordPress dashboard (Plugins → Installed Plugins → IgnitionDeck → Update) or via WP-CLI using 'wp plugin update ignitiondeck'. As an interim workaround if patching is delayed, restrict user registration to prevent untrusted accounts from being created, audit existing low-privilege user accounts for legitimacy, and monitor WordPress access logs for suspicious activity from authenticated users accessing admin-level functionality. Review the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/ignitiondeck/vulnerability/wordpress-ignitiondeck-plugin-2-0-10-broken-access-control-vulnerability for additional context. No vendor-released workaround has been published beyond upgrading to the patched version.