What is the CVSS score of CVE-2025-62966?

CVE-2025-62966 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.0%.

GoCache CDN CVE-2025-62966

MEDIUM

Missing Authorization (CWE-862)

2025-10-27 audit@patchstack.com

WordPress Authentication Bypass Wordpress Plugin

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

5.4 MEDIUM

Low-privilege authenticated account required (PR:L); no confidentiality impact per description; limited integrity and availability impact on plugin-controlled CDN settings.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 25, 2026 - 12:18 vuln.today

DescriptionCVE.org

Missing Authorization vulnerability in Apiki GoCache gocache-cdn allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GoCache: from n/a through <= 1.3.6.

AnalysisAI

Missing authorization in the GoCache CDN WordPress plugin (versions through 1.3.6) allows low-privileged authenticated users to invoke restricted plugin actions beyond their intended access level, resulting in limited integrity and availability impact against CDN configuration. Reported by Patchstack via coordinated disclosure, with no public exploit code identified and an EPSS of 0.03% (10th percentile), indicating very low near-term exploitation probability. No active exploitation has been confirmed by CISA KEV.

Technical ContextAI

The root cause is CWE-862 (Missing Authorization), a class of flaw common in WordPress plugins where AJAX handlers, REST API endpoints, or admin-page callbacks fail to verify that the calling user holds an adequate capability before executing a privileged action. In WordPress, this typically manifests as omitted current_user_can() checks or absent nonce-plus-capability validation on sensitive plugin routes. The GoCache CDN plugin by Apiki provides CDN integration for WordPress installations. The CVSS vector (PR:L) confirms that at minimum a low-privileged WordPress account (e.g., Subscriber or Contributor) is sufficient to trigger the unprotected code path. The 'Authentication Bypass' tag indicates the missing check allows a lower role to impersonate or exercise the capabilities of a higher role within the plugin's own permission model, rather than bypassing WordPress core authentication entirely.

Affected ProductsAI

The GoCache CDN WordPress plugin by Apiki is affected in all versions from the beginning of its release history through and including version 1.3.6. No CPE string was formally published in the available intelligence. Full details are documented in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/gocache-cdn/vulnerability/wordpress-gocache-plugin-1-3-6-broken-access-control-vulnerability.

RemediationAI

Upgrade the GoCache CDN WordPress plugin to a version beyond 1.3.6 when a patched release is made available by Apiki; verify the exact fixed version at the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/gocache-cdn/vulnerability/wordpress-gocache-plugin-1-3-6-broken-access-control-vulnerability) and the WordPress plugin repository before updating. A patched version is not independently confirmed from current available data - the fix version should be validated directly with the vendor. As a compensating control where immediate upgrade is not possible, disable open user registration on the WordPress site to prevent untrusted low-privilege accounts from being created, which directly shrinks the exploitable attacker pool. Alternatively, deactivate the GoCache CDN plugin entirely until a patch is confirmed if CDN functionality is non-critical to operations; deactivation eliminates the attack surface with no side effects beyond CDN service interruption. Monitor WordPress admin logs for unexpected CDN configuration changes as a detection measure.