What is the CVSS score of CVE-2025-62952?

CVE-2025-62952 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Wordpress Plugin are affected by CVE-2025-62952?

QuantumCloud ChatBot plugin for WordPress versions up to 7.7.3 contains broken access control that allows low-privilege authenticated users to access and modify data without proper authorization,…

How to fix or mitigate CVE-2025-62952?

Within 24 hours: Audit WordPress installations for QuantumCloud ChatBot plugin presence and current version; disable the plugin if not mission-critical. Within 7 days: Restrict plugin access to administrator accounts only via WordPress role-based controls; conduct privilege access review for all WordPress users. Within 30 days: Monitor vendor advisory for patch availability; prepare upgrade plan to apply patch immediately upon release; consider alternative plugins with proven access control implementation.

Wordpress Plugin CVE-2025-62952

MEDIUM

Missing Authorization (CWE-862)

2025-10-27 audit@patchstack.com

WordPress Authentication Bypass Wordpress Plugin

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Severity Changed

Apr 23, 2026 - 15:43 NVD

HIGH MEDIUM

CVSS changed

Apr 23, 2026 - 15:43 NVD

8.8 (HIGH) 4.3 (MEDIUM)

Analysis Generated

Apr 01, 2026 - 15:22 vuln.today

CVE Published

Oct 27, 2025 - 02:15 nvd

HIGH 8.8

DescriptionCVE.org

Missing Authorization vulnerability in QuantumCloud ChatBot chatbot allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ChatBot: from n/a through <= 7.7.3.

AnalysisAI

Broken access control in QuantumCloud ChatBot plugin for WordPress through version 7.7.3 allows authenticated attackers with low privileges to exploit misconfigured authorization checks, potentially leading to high-impact data breaches, unauthorized modifications, and service disruption. EPSS scoring indicates low exploitation probability (0.05%, 15th percentile), and no public exploit identified at time of analysis. The vulnerability stems from missing authorization controls (CWE-862), requiring only network access and low-privilege credentials with no user interaction, making it readily exploitable once an account is compromised.

Technical ContextAI

This vulnerability affects the ChatBot plugin by QuantumCloud for WordPress installations. The root cause is classified as CWE-862 (Missing Authorization), a common web application security flaw where the application fails to properly verify whether users have permission to perform requested actions. In WordPress plugin architecture, this typically manifests when AJAX handlers, REST API endpoints, or administrative functions lack capability checks (such as WordPress's current_user_can() or check_admin_referer()). The plugin's access control mechanisms are improperly configured, allowing authenticated users to bypass intended permission boundaries and access functionality or data restricted to higher privilege levels. The vulnerability exists across all versions up to and including 7.7.3, suggesting a fundamental design flaw in the authorization framework rather than a recent regression.

Affected ProductsAI

The vulnerability affects QuantumCloud ChatBot plugin for WordPress, specifically all versions from the initial release through version 7.7.3 inclusive. This is a third-party WordPress plugin available through the WordPress.org plugin repository, used to add AI-powered chatbot functionality to WordPress websites. The broad version range suggests the authorization flaw has existed since the plugin's early development. Affected installations include any WordPress site running the vulnerable plugin versions with user registration enabled or where low-privilege accounts exist. The vendor advisory and technical details are available through Patchstack's vulnerability database at https://patchstack.com/database/Wordpress/Plugin/chatbot/vulnerability/wordpress-chatbot-plugin-7-3-0-broken-access-control-vulnerability.

RemediationAI

Organizations should immediately upgrade the QuantumCloud ChatBot plugin to version 7.7.4 or later, which addresses the authorization bypass vulnerability. The update can be performed through the WordPress admin dashboard under Plugins > Updates, or by downloading the latest version from the WordPress.org plugin repository. As an interim mitigation for environments where immediate patching is not feasible, administrators should review and restrict user registration settings, audit existing low-privilege user accounts for legitimacy, implement additional authentication layers (such as two-factor authentication), and monitor access logs for unusual chatbot-related activity from low-privilege accounts. Organizations should also review their chatbot configuration to ensure sensitive data is not accessible through the plugin interface. Consider temporarily disabling the plugin if it processes highly sensitive information until patching is complete. Complete remediation guidance is available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/chatbot/vulnerability/wordpress-chatbot-plugin-7-3-0-broken-access-control-vulnerability.