What is the CVSS score of CVE-2025-62925?

CVE-2025-62925 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2025-62925?

CVE-2025-62925 is a privilege escalation vulnerability in the Conversios.io WooCommerce analytics plugin (versions ≤7.2.13) that allows any authenticated user to access or modify sensitive analytics…

How to fix or mitigate CVE-2025-62925?

Within 24 hours: Identify all WooCommerce installations using Conversios.io plugin and document current versions. Within 7 days: Disable the Conversios.io plugin or restrict user access permissions to administrator-only roles pending vendor patch availability; audit recent plugin access logs for unauthorized configuration changes. Within 30 days: Monitor vendor security advisories for a patched version; when available, test and deploy the updated plugin and conduct access control review to ensure proper role-based restrictions are enforced.

WordPress CVE-2025-62925

MEDIUM

Missing Authorization (CWE-862)

2025-10-27 audit@patchstack.com

WordPress Authentication Bypass

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Severity Changed

Apr 23, 2026 - 15:43 NVD

HIGH MEDIUM

CVSS changed

Apr 23, 2026 - 15:43 NVD

8.1 (HIGH) 5.4 (MEDIUM)

Analysis Generated

Apr 01, 2026 - 15:22 vuln.today

CVE Published

Oct 27, 2025 - 02:15 nvd

HIGH 8.1

DescriptionCVE.org

Missing Authorization vulnerability in Conversios Conversios.io enhanced-e-commerce-for-woocommerce-store allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Conversios.io: from n/a through <= 7.2.13.

AnalysisAI

Broken access control in Conversios.io WooCommerce analytics plugin (versions ≤7.2.13) allows authenticated low-privilege users to access or modify high-sensitivity data without proper authorization checks. The vulnerability enables privilege escalation where any authenticated user can bypass intended access restrictions to read confidential information or alter plugin settings/data. EPSS score of 0.03% (9th percentile) indicates low predicted exploitation probability; no public exploit identified at time of analysis.

Technical ContextAI

This is a Missing Authorization vulnerability (CWE-862) in the Conversios.io WordPress plugin for WooCommerce enhanced e-commerce tracking and analytics. CWE-862 represents failures where security-critical operations execute without verifying that the user has appropriate permission to perform the requested action. WordPress plugins must implement capability checks (using functions like current_user_can()) before executing privileged operations. This vulnerability stems from incorrectly configured or completely absent access control checks on plugin endpoints or functionality, allowing any authenticated user to perform actions that should be restricted to administrators or specific roles. The affected plugin integrates with Google Analytics, Facebook Pixel, and other marketing platforms, handling sensitive e-commerce data including customer information, order details, and conversion tracking configurations.

Affected ProductsAI

The vulnerability affects WordPress sites running the Conversios.io (Enhanced E-Commerce for WooCommerce Store) plugin in all versions from the initial release through version 7.2.13 inclusive. This plugin provides Google Analytics 4, Facebook Pixel, and enhanced e-commerce tracking integration for WooCommerce stores. The vendor Conversios develops this plugin which has significant adoption among WooCommerce merchants for tracking customer journeys and conversion analytics. According to the Patchstack advisory referenced, the vulnerability was present in version 7.2.10 and persisted through at least version 7.2.13, suggesting multiple vulnerable releases in active deployment. WordPress administrators can verify their installation version through the WordPress admin panel under Plugins or by checking the plugin header in wp-content/plugins/enhanced-e-commerce-for-woocommerce-store/enhanced-e-commerce-for-woocommerce-store.php.

RemediationAI

WordPress administrators should immediately update the Conversios.io plugin to version 7.2.14 or later if available, as versions through 7.2.13 are confirmed vulnerable. Access the WordPress admin dashboard, navigate to Plugins > Installed Plugins, locate Enhanced E-Commerce for WooCommerce Store, and apply available updates. If an updated version is not yet available through the WordPress repository, consider temporarily deactivating the plugin until a patched version is released, particularly on sites with untrusted authenticated users. Review user accounts and ensure the principle of least privilege is enforced, removing unnecessary user accounts and demoting users to subscriber or customer roles if they do not require elevated permissions. Audit plugin configuration and analytics data access logs if available to identify any unauthorized access that may have occurred prior to patching. Consult the Patchstack vulnerability database entry at https://patchstack.com/database/Wordpress/Plugin/enhanced-e-commerce-for-woocommerce-store/vulnerability/wordpress-conversios-io-plugin-7-2-10-broken-access-control-vulnerability for additional technical details and vendor response timeline. Monitor the official Conversios plugin changelog and security advisories for patch release announcements.