What is the CVSS score of CVE-2025-62953?

CVE-2025-62953 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Wordpress Plugin are affected by CVE-2025-62953?

CVE-2025-62953 affects Welcart e-Commerce WordPress plugin versions through 2.11.24, enabling authenticated users with low privileges to bypass authorization controls and perform actions reserved for…

How to fix or mitigate CVE-2025-62953?

Within 24 hours: Audit Welcart plugin version across all WordPress instances and identify any deployments running version 2.11.24 or earlier; document all user accounts with authenticated access. Within 7 days: Restrict non-administrative user roles' permissions in WordPress until a vendor patch is released; consider disabling the Welcart plugin if low-privilege user accounts cannot be removed. Within 30 days: Monitor vendor advisory channels and apply Welcart patch immediately upon release; review access logs for unauthorized data access during the interim period.

Wordpress Plugin CVE-2025-62953

MEDIUM

Missing Authorization (CWE-862)

2025-10-27 audit@patchstack.com

WordPress Authentication Bypass Wordpress Plugin

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Severity Changed

Apr 23, 2026 - 15:43 NVD

HIGH MEDIUM

CVSS changed

Apr 23, 2026 - 15:43 NVD

8.8 (HIGH) 4.3 (MEDIUM)

Analysis Generated

Apr 01, 2026 - 15:22 vuln.today

CVE Published

Oct 27, 2025 - 02:15 nvd

HIGH 8.8

DescriptionCVE.org

Missing Authorization vulnerability in info@welcart Welcart e-Commerce usc-e-shop allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Welcart e-Commerce: from n/a through <= 2.11.24.

AnalysisAI

Broken access control in Welcart e-Commerce WordPress plugin through version 2.11.24 allows authenticated users to bypass authorization checks and perform unauthorized actions with elevated privileges. This authentication bypass vulnerability (CWE-862) enables low-privileged authenticated attackers to access, modify, or delete data beyond their permission level, potentially compromising store operations, customer data, and site integrity. EPSS score of 0.05% (15th percentile) suggests low immediate exploitation probability, though no public exploit has been identified at time of analysis.

Technical ContextAI

This vulnerability stems from CWE-862 (Missing Authorization), specifically affecting the Welcart e-Commerce plugin for WordPress (usc-e-shop), a Japanese e-commerce solution. The flaw manifests as incorrectly configured or absent access control checks that fail to verify whether an authenticated user has sufficient permissions before executing sensitive operations. In WordPress plugin architecture, this typically occurs when plugin endpoints or admin AJAX handlers lack proper capability checks (such as current_user_can() validations), allowing any logged-in user to invoke administrative or privileged functions. The vulnerability was reported through Patchstack's audit process, indicating discovery via security research rather than active exploitation. The affected product operates within WordPress's role-based access control system, where the missing authorization checks undermine the intended security boundary between subscriber/customer roles and administrator/shop manager roles.

Affected ProductsAI

The vulnerability affects Welcart e-Commerce plugin for WordPress, specifically the usc-e-shop component, in all versions up to and including 2.11.24. Welcart is a popular Japanese e-commerce solution for WordPress sites, providing shopping cart functionality, payment processing integration, and order management capabilities. The affected version range begins from an unspecified early version (listed as 'n/a' in vulnerability data) through the confirmed vulnerable version 2.11.24. Organizations running WordPress installations with the usc-e-shop plugin at version 2.11.24 or earlier should consider themselves affected. The vulnerability was documented by Patchstack with detailed information available at their advisory database entry for this specific plugin and version range.

RemediationAI

Organizations running affected Welcart e-Commerce installations should immediately check their current plugin version via the WordPress admin dashboard under Plugins section. Upgrade to a patched version of the usc-e-shop plugin newer than 2.11.24 as soon as the vendor releases an update addressing this CVE. Monitor the official Welcart WordPress plugin repository and the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/usc-e-shop/vulnerability/wordpress-welcart-e-commerce-plugin-2-11-24-broken-access-control-vulnerability for patch availability and release announcements. Upstream fix available (PR/commit); released patched version not independently confirmed from available data at time of analysis. As interim mitigation while awaiting patches, implement defense-in-depth measures including restricting user registration to prevent arbitrary attackers from obtaining the low-privileged authentication required for exploitation, reviewing existing user accounts for suspicious low-privilege accounts that may have been created for exploitation purposes, implementing web application firewall rules to monitor for unusual API or admin-ajax.php requests from non-administrative users, and enabling comprehensive WordPress audit logging to detect potential exploitation attempts. Organizations unable to patch immediately should consider temporarily disabling the plugin if e-commerce functionality can be suspended, or restricting site access to trusted users only until remediation is completed.