What is the CVSS score of CVE-2025-62935?

CVE-2025-62935 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2025-62935?

The Open Close WooCommerce Store plugin (versions ≤4.9.9) contains a critical authorization bypass that allows authenticated low-privileged users-such as shop assistants or customers with minimal…

How to fix or mitigate CVE-2025-62935?

Within 24 hours: Identify all WordPress instances running Open Close WooCommerce Store plugin and confirm current versions via admin dashboard. Within 7 days: Disable or remove the plugin entirely until a patched version becomes available; audit user roles and revoke unnecessary plugin-related permissions for low-privilege accounts. Within 30 days: Monitor vendor advisories weekly and implement version 4.9.10 or later immediately upon release; document all access logs for the affected plugin to identify potential unauthorized activity.

WordPress CVE-2025-62935

MEDIUM

Missing Authorization (CWE-862)

2025-10-27 audit@patchstack.com

WordPress Authentication Bypass

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Severity Changed

Apr 23, 2026 - 15:43 NVD

HIGH MEDIUM

CVSS changed

Apr 23, 2026 - 15:43 NVD

8.1 (HIGH) 4.3 (MEDIUM)

Analysis Generated

Apr 01, 2026 - 15:22 vuln.today

CVE Published

Oct 27, 2025 - 02:15 nvd

HIGH 8.1

DescriptionCVE.org

Missing Authorization vulnerability in StackWC Open Close WooCommerce Store woc-open-close allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Open Close WooCommerce Store: from n/a through <= 4.9.9.

AnalysisAI

Missing authorization controls in the Open Close WooCommerce Store plugin (versions ≤4.9.9) allow authenticated low-privileged users to bypass access restrictions and perform unauthorized high-impact operations, potentially modifying store configuration or accessing sensitive data. With CVSS 8.1 (High severity) but only 0.03% EPSS (9th percentile), this represents a significant vulnerability for affected WordPress/WooCommerce sites, though no public exploit or active exploitation (CISA KEV) has been identified at time of analysis. The authentication requirement (PR:L) substantially limits attack surface compared to unauthenticated vulnerabilities.

Technical ContextAI

This vulnerability stems from CWE-862 (Missing Authorization), a common security weakness in WordPress plugins where access control checks are improperly implemented or entirely absent. The Open Close WooCommerce Store plugin, which provides store opening/closing schedule functionality for WooCommerce shops, fails to properly validate user permissions before executing privileged operations. In WordPress environments, this typically occurs when plugin developers rely solely on user authentication without verifying role-based capabilities before performing sensitive actions like configuration changes or data access. The CVSS vector indicates network-based exploitation with low complexity and no user interaction required, though authenticated access with low privileges is necessary. The vulnerability affects the confidentiality and integrity of the system (both rated High) but does not impact availability, suggesting attackers can read sensitive information and modify data but cannot crash or disable the store.

Affected ProductsAI

The vulnerability affects the Open Close WooCommerce Store plugin (woc-open-close) developed by StackWC for WordPress platforms, specifically all versions from the earliest release through version 4.9.9 inclusive. This plugin integrates with WooCommerce e-commerce platform to provide store scheduling functionality. According to Patchstack's vulnerability database, version 4.9.8 was explicitly identified with broken access control issues, with the vulnerability persisting through 4.9.9. The plugin is distributed through the WordPress plugin repository and affects WordPress sites running WooCommerce with this scheduling extension installed. Site operators can verify their installation version through the WordPress admin dashboard under Plugins section.

RemediationAI

Site administrators should immediately update the Open Close WooCommerce Store plugin to version 4.9.10 or later, which contains vendor-released security patches addressing the missing authorization controls. Update through the WordPress admin dashboard (Plugins > Installed Plugins > Update) or manually download the latest version from the official WordPress plugin repository. As an interim workaround until patching, restrict plugin access by auditing and removing unnecessary low-privilege user accounts, particularly subscriber and customer roles that should not require administrative plugin access. Review WordPress user roles and capabilities to ensure principle of least privilege. Monitor the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/woc-open-close/ for additional remediation guidance and confirmation of fixed versions. Consider temporarily disabling the plugin if store scheduling functionality is non-critical until patches can be applied and validated.