What is the CVSS score of CVE-2025-62980?

CVE-2025-62980 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.1%.

Persian Admin Fonts CVE-2025-62980

MEDIUM

Missing Authorization (CWE-862)

2025-10-27 audit@patchstack.com

WordPress Authentication Bypass Wordpress Plugin

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

5.4 MEDIUM

PR:L reflects mandatory WordPress authentication; C:N because no data is disclosed; I:L and A:L reflect limited admin font setting manipulation only.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 25, 2026 - 12:16 vuln.today

DescriptionCVE.org

Missing Authorization vulnerability in MDZ Persian Admnin Fonts persian-admin-fonts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Persian Admnin Fonts: from n/a through <= 4.1.03.

AnalysisAI

Missing authorization in the MDZ Persian Admin Fonts WordPress plugin (versions through 4.1.03) allows low-privileged authenticated users to perform actions reserved for administrators due to absent capability checks. The CVSS vector (PR:L, AV:N, S:U) confirms that any authenticated WordPress user - such as a subscriber or contributor - can reach the vulnerable endpoints over the network with no user interaction required. No public exploit code has been identified at time of analysis, and EPSS sits at 0.06% (18th percentile), indicating negligible observed exploitation activity.

Technical ContextAI

The root cause is CWE-862 (Missing Authorization), meaning the plugin's server-side handlers execute privileged operations without verifying whether the requesting user holds the appropriate WordPress capability (e.g., manage_options or a custom cap). WordPress plugins are expected to gate all AJAX and REST endpoints with current_user_can() or equivalent checks; skipping these checks allows any logged-in user to invoke admin-level functionality. The affected product is a localization/aesthetic plugin that customizes fonts displayed in the WordPress administration panel for Persian/Farsi script environments. The CVSS vector AV:N/AC:L confirms the endpoints are reachable over the network with no special conditions beyond authentication.

Affected ProductsAI

The MDZ Persian Admin Fonts WordPress plugin by MDZ is affected in all versions from n/a (initial release) through and including version 4.1.03. No CPE string was provided in the available intelligence. The full Patchstack advisory, which serves as the primary reference, is available at https://patchstack.com/database/Wordpress/Plugin/persian-admin-fonts/vulnerability/wordpress-persian-admnin-fonts-plugin-4-1-03-broken-access-control-vulnerability.

RemediationAI

No vendor-released patched version has been independently confirmed in the available data - the Patchstack advisory should be consulted for any updated release. As an immediate compensating control, administrators who do not require the plugin should deactivate and delete it, eliminating the attack surface entirely with no functional side effects for non-Persian-locale deployments. If the plugin is required, restricting WordPress user roles to the minimum necessary (removing Subscriber/Contributor roles if unused) reduces the pool of potential exploiters; this has the trade-off of limiting legitimate collaborative features. Site administrators should also monitor the WordPress plugin repository and the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/persian-admin-fonts/vulnerability/wordpress-persian-admnin-fonts-plugin-4-1-03-broken-access-control-vulnerability for a patched release.