What is the CVSS score of CVE-2025-64352?

CVE-2025-64352 has a CVSS 3.1 base score of 2.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Essential Addons for Elementor CVE-2025-64352

LOW

Missing Authorization (CWE-862)

2025-10-31 audit@patchstack.com

WordPress Authentication Bypass Essential Addons For Elementor Wordpress Plugin Wpdeveloper

2.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

2.7 LOW

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

2.7 LOW

Network-accessible WordPress endpoint, no complexity, but PR:H required; impact is confidentiality-only at low severity, no integrity or availability effect.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 25, 2026 - 12:01 vuln.today

CVE Published

Oct 31, 2025 - 12:15 cve.org

LOW 2.7

DescriptionCVE.org

Missing Authorization vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Essential Addons for Elementor: from n/a through <= 6.2.4.

AnalysisAI

Broken access control in WPDeveloper Essential Addons for Elementor (lite, ≤6.2.4) permits a high-privileged authenticated WordPress user to access restricted functionality or data beyond their intended authorization scope. The vulnerability stems from missing server-side authorization checks (CWE-862), meaning the plugin fails to verify whether the requesting principal has permission to perform a given action. With a CVSS score of 2.7 and EPSS at 0.03%, real-world exploitation risk is low; no public exploit code or active KEV listing has been identified at time of analysis.

Technical ContextAI

Essential Addons for Elementor is a WordPress plugin (CPE: cpe:2.3:a:wpdeveloper:essential_addons_for_elementor:*:*:*:*:lite:wordpress:*:*) that extends the Elementor page builder with additional widgets and features. CWE-862 (Missing Authorization) indicates that one or more plugin endpoints or AJAX handlers execute privileged operations without validating whether the authenticated caller holds the necessary capability. In WordPress, this typically manifests as a registered action or REST route that checks nonce validity (authentication) but omits a capability check (authorization), allowing any sufficiently privileged role - in this case, high-privilege accounts per the PR:H CVSS metric - to invoke functionality or read data that should be further gated. The 'Authentication Bypass' tag from Patchstack likely describes bypassing a secondary authorization layer rather than bypassing WordPress login itself, consistent with the broken access control (not credential bypass) framing.

RemediationAI

Update Essential Addons for Elementor (lite) to a version beyond 6.2.4 via the WordPress plugin dashboard or by downloading directly from the WordPress plugin repository. The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/essential-addons-for-elementor-lite/vulnerability/wordpress-essential-addons-for-elementor-plugin-6-2-4-broken-access-control-vulnerability should be consulted for the confirmed patched version, as no explicit fix version was provided in available intelligence. An exact patched release version has not been independently confirmed from the data provided. As a compensating control prior to patching, site administrators can restrict admin-panel access to trusted IP ranges using server-level rules (nginx/Apache allow/deny directives), reducing the exposure window for high-privileged session abuse - though this does not eliminate the vulnerability. Given the low severity and PR:H requirement, immediate emergency response is not warranted for most environments.