CVE-2025-63015
MEDIUMCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
2Description
Missing Authorization vulnerability in paysera WooCommerce Payment Gateway - Paysera woo-payment-gateway-paysera allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Payment Gateway - Paysera: from n/a through <= 3.10.0.
Analysis
Paysera WooCommerce Payment Gateway plugin through version 3.10.0 contains a missing authorization flaw allowing authenticated users with lower privilege levels to access or perform actions intended for higher-privilege roles, resulting in limited information disclosure. The vulnerability stems from incorrectly configured access control checks and has an EPSS score of 0.04% (11th percentile), indicating low real-world exploitation probability despite the CVSS 4.3 rating and authenticated attack vector.
Technical Context
The vulnerability resides in the Paysera WooCommerce Payment Gateway plugin (CPE: woo-payment-gateway-paysera), a WordPress plugin that integrates Paysera payment processing into WooCommerce e-commerce sites. The root cause is classified under CWE-862 (Missing Authorization), which indicates that the plugin fails to properly verify user roles and capabilities before granting access to sensitive functions or data. WordPress plugins typically leverage WordPress's role-based access control (RBAC) system through functions like `current_user_can()` to enforce capability checks; this plugin appears to have omitted or misconfigured such checks in one or more administrative or payment-related endpoints. The issue affects all versions from an unspecified baseline through version 3.10.0, suggesting the vulnerability has existed across multiple releases.
Affected Products
Paysera WooCommerce Payment Gateway plugin (woo-payment-gateway-paysera) versions up to and including 3.10.0 are affected. The affected version range begins from an unspecified baseline and extends through 3.10.0. The plugin is hosted on WordPress.org and is described as a WooCommerce payment gateway integration for Paysera payment processing. Affected WordPress installations running version 3.10.0 or earlier of this plugin on any WordPress/WooCommerce combination should be considered in scope. The vulnerability information is available via the Patchstack vulnerability database entry at the provided reference URL.
Remediation
Update the Paysera WooCommerce Payment Gateway plugin to a patched version above 3.10.0 immediately via the WordPress plugin dashboard (Plugins > Installed Plugins > Paysera WooCommerce Payment Gateway > Update). If an update is not yet available from the plugin developer, restrict plugin administrative and payment configuration access to trusted administrator-level users only, and review user role assignments to remove unnecessary authenticated user access to payment gateway settings. Monitor the Patchstack database entry and official plugin repository for patched version releases. In the interim, disable the plugin if not actively processing payments, and consider using an alternative payment gateway if the vendor's update timeline is uncertain.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today