What is the CVSS score of CVE-2025-63015?

CVE-2025-63015 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2025-63015

MEDIUM

Missing Authorization (CWE-862)

2025-12-09 audit@patchstack.com

WordPress Authentication Bypass

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 01, 2026 - 15:22 vuln.today

CVE Published

Dec 09, 2025 - 16:18 nvd

MEDIUM 4.3

DescriptionCVE.org

Missing Authorization vulnerability in paysera WooCommerce Payment Gateway - Paysera woo-payment-gateway-paysera allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Payment Gateway - Paysera: from n/a through <= 3.10.0.

AnalysisAI

Paysera WooCommerce Payment Gateway plugin through version 3.10.0 contains a missing authorization flaw allowing authenticated users with lower privilege levels to access or perform actions intended for higher-privilege roles, resulting in limited information disclosure. The vulnerability stems from incorrectly configured access control checks and has an EPSS score of 0.04% (11th percentile), indicating low real-world exploitation probability despite the CVSS 4.3 rating and authenticated attack vector.

Technical ContextAI

The vulnerability resides in the Paysera WooCommerce Payment Gateway plugin (CPE: woo-payment-gateway-paysera), a WordPress plugin that integrates Paysera payment processing into WooCommerce e-commerce sites. The root cause is classified under CWE-862 (Missing Authorization), which indicates that the plugin fails to properly verify user roles and capabilities before granting access to sensitive functions or data. WordPress plugins typically leverage WordPress's role-based access control (RBAC) system through functions like current_user_can() to enforce capability checks; this plugin appears to have omitted or misconfigured such checks in one or more administrative or payment-related endpoints. The issue affects all versions from an unspecified baseline through version 3.10.0, suggesting the vulnerability has existed across multiple releases.

Affected ProductsAI

Paysera WooCommerce Payment Gateway plugin (woo-payment-gateway-paysera) versions up to and including 3.10.0 are affected. The affected version range begins from an unspecified baseline and extends through 3.10.0. The plugin is hosted on WordPress.org and is described as a WooCommerce payment gateway integration for Paysera payment processing. Affected WordPress installations running version 3.10.0 or earlier of this plugin on any WordPress/WooCommerce combination should be considered in scope. The vulnerability information is available via the Patchstack vulnerability database entry at the provided reference URL.

RemediationAI

Update the Paysera WooCommerce Payment Gateway plugin to a patched version above 3.10.0 immediately via the WordPress plugin dashboard (Plugins > Installed Plugins > Paysera WooCommerce Payment Gateway > Update). If an update is not yet available from the plugin developer, restrict plugin administrative and payment configuration access to trusted administrator-level users only, and review user role assignments to remove unnecessary authenticated user access to payment gateway settings. Monitor the Patchstack database entry and official plugin repository for patched version releases. In the interim, disable the plugin if not actively processing payments, and consider using an alternative payment gateway if the vendor's update timeline is uncertain.