What is the CVSS score of CVE-2025-62995?

CVE-2025-62995 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

MultiParcels Shipping CVE-2025-62995

MEDIUM

Missing Authorization (CWE-862)

2025-12-09 audit@patchstack.com

WordPress Authentication Bypass Woocommerce Wordpress Plugin

4.3

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Requires an existing low-privilege authenticated account so PR:L; network-reachable with no interaction (AV:N/UI:N/AC:L); missing authorization yields limited integrity-only impact (I:L, C:N/A:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Metadata Corrected

Oct 07, 2026 - 22:40 vuln.today

tag: Woocommerce added

Analysis Generated

Oct 07, 2026 - 22:22 vuln.today

CVE Published

Dec 09, 2025 - 16:18 cve.org

MEDIUM 4.3

DescriptionCVE.org

Missing Authorization vulnerability in multiparcels MultiParcels Shipping For WooCommerce multiparcels-shipping-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MultiParcels Shipping For WooCommerce: from n/a through <= 1.30.12.

AnalysisAI

Missing authorization in the MultiParcels Shipping For WooCommerce plugin (versions <= 1.30.12) allows an authenticated attacker with low privileges to perform unauthorized actions that are normally restricted, leading to limited integrity impact. This low-severity flaw (CVSS 4.3) requires the attacker to already possess a valid low-privilege account on the affected WordPress/WooCommerce site, and it does not permit data disclosure or denial of service. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS score is 0.22% (11th percentile).

Technical ContextAI

The vulnerability is a Missing Authorization (CWE-862) issue in the MultiParcels Shipping For WooCommerce WordPress plugin, which integrates WooCommerce stores with the MultiParcels shipping service. The plugin fails to verify that a user has the necessary capabilities before executing certain actions, allowing a low-privilege authenticated user (e.g., a customer or subscriber) to invoke functionality intended for higher-privileged users. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) indicates the flaw is network-reachable, requires low privileges, needs no user interaction, and impacts only integrity. Despite the 'Authentication Bypass' tag from Patchstack, the assessed vector requires authentication, so it is an authorization bypass rather than an authentication bypass. The specific vulnerable function or endpoint is not named in the available information, but it is confined to the plugin's code and affects versions up to and including 1.30.12.

Affected ProductsAI

Affected product is the MultiParcels Shipping For WooCommerce plugin for WordPress, all versions from n/a through 1.30.12 (i.e., <= 1.30.12). The plugin requires WooCommerce to be installed and active. No CPE string was provided in the input data. The vendor advisory is available at the Patchstack database: https://patchstack.com/database/Wordpress/Plugin/multiparcels-shipping-for-woocommerce/vulnerability/wordpress-multiparcels-shipping-for-woocommerce-plugin-1-30-12-broken-access-control-vulnerability?_s_id=cve.

RemediationAI

No exact patched version is specified in the provided data; consult the Patchstack advisory for the latest fixed version and update the MultiParcels Shipping For WooCommerce plugin once a patch is released (likely a version greater than 1.30.12). If no update is available, the most reliable mitigation is to temporarily deactivate the plugin until a fix is provided, as the specific vulnerable function is unnamed and no targeted workaround is documented. Alternatively, restrict the plugin's functionality to trusted users by ensuring that only administrators have access to shipping-related settings and by disabling open user registration if not needed, though this may impact legitimate customer accounts. Monitor for unauthorized changes to shipping configurations. The advisory URL is: https://patchstack.com/database/Wordpress/Plugin/multiparcels-shipping-for-woocommerce/vulnerability/wordpress-multiparcels-shipping-for-woocommerce-plugin-1-30-12-broken-access-control-vulnerability?_s_id=cve.