What is the CVSS score of CVE-2025-62919?

CVE-2025-62919 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.1%.

Which versions of Wordpress Plugin are affected by CVE-2025-62919?

The TS Demo Importer WordPress plugin (versions 0.1.3 and earlier) contains a critical authentication bypass vulnerability (CVSS 9.1) that allows unauthenticated attackers to modify site content and…

How to fix or mitigate CVE-2025-62919?

Within 24 hours: identify all WordPress instances using TS Demo Importer plugin and document affected versions via admin dashboard or WP-CLI. Within 7 days: disable or uninstall the plugin immediately on all instances-update to version 0.1.4 or later if released, or remove entirely if no patched version is available. Within 30 days: conduct site integrity audit (posts, pages, settings modifications), review access logs for suspicious activity post-update, and evaluate alternative demo content management solutions with active security support.

Wordpress Plugin CVE-2025-62919

MEDIUM

Missing Authorization (CWE-862)

2025-10-27 audit@patchstack.com

WordPress Authentication Bypass Wordpress Plugin

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Severity Changed

Apr 23, 2026 - 15:43 NVD

CRITICAL MEDIUM

CVSS changed

Apr 23, 2026 - 15:43 NVD

9.1 (CRITICAL) 5.4 (MEDIUM)

Analysis Generated

Apr 01, 2026 - 15:22 vuln.today

CVE Published

Oct 27, 2025 - 02:15 nvd

CRITICAL 9.1

DescriptionCVE.org

Missing Authorization vulnerability in themeshopy TS Demo Importer ts-demo-importer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TS Demo Importer: from n/a through <= 0.1.3.

AnalysisAI

Unauthenticated remote attackers can bypass authorization controls in TS Demo Importer plugin for WordPress (versions ≤0.1.3), enabling high-impact integrity and availability compromise through misconfigured access control. EPSS scoring at 7th percentile (0.07%) suggests low observed exploitation probability. No CISA KEV listing indicates no confirmed active exploitation at time of analysis, though the authentication bypass tag and critical CVSS 9.1 rating warrant immediate attention for exposed WordPress installations.

Technical ContextAI

This vulnerability represents a classic broken access control condition (CWE-862: Missing Authorization) in the TS Demo Importer WordPress plugin developed by themeshopy. The plugin appears designed for importing demo content during WordPress theme setup. The flaw stems from inadequately implemented authorization checks on privileged functions, allowing security level configurations to be exploited. As a WordPress plugin vulnerability, it affects sites where the plugin is installed and active. The CVSS vector shows network-accessible attack surface with low complexity, requiring no authentication or user interaction, indicating exposed endpoints lack proper capability checks before executing sensitive operations like content import, modification, or system configuration changes.

Affected ProductsAI

The vulnerability affects TS Demo Importer plugin for WordPress, developed by themeshopy, in all versions from initial release through version 0.1.3 inclusive. The advisory specifically identifies version 0.1.2 as vulnerable with confirmed broken access control. Precise version range encompasses versions 0.1.0, 0.1.1, 0.1.2, and 0.1.3. Affected installations include any WordPress site with the plugin installed and activated, regardless of underlying WordPress core version. Detailed technical analysis and vulnerable version confirmation available via Patchstack database reference at https://patchstack.com/database/Wordpress/Plugin/ts-demo-importer/vulnerability/wordpress-ts-demo-importer-plugin-0-1-2-broken-access-control-vulnerability.

RemediationAI

Immediately update TS Demo Importer plugin to version 0.1.4 or later if available through WordPress plugin repository. As interim mitigation if patched version deployment is delayed, deactivate and remove the plugin entirely if demo import functionality is no longer required post-theme setup, as the plugin typically serves one-time configuration purposes. For production sites requiring the functionality, implement web application firewall rules restricting access to plugin endpoints to authenticated administrator sessions only, and review WordPress user roles to ensure principle of least privilege. Consult the official Patchstack advisory for vendor-specific remediation guidance and verify patch availability at https://patchstack.com/database/Wordpress/Plugin/ts-demo-importer/. Monitor WordPress security logs for unauthorized access attempts to demo import endpoints during the remediation window.