What is the CVSS score of CVE-2025-69022?

CVE-2025-69022 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.0%.

WordPress CVE-2025-69022

MEDIUM

Missing Authorization (CWE-862)

2025-12-30 audit@patchstack.com

WordPress Authentication Bypass

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Apr 01, 2026 - 15:22 vuln.today

CVE Published

Dec 30, 2025 - 11:16 nvd

MEDIUM 5.4

DescriptionCVE.org

Missing Authorization vulnerability in Weblizar - WordPress Themes & Plugin HR Management Lite hr-management-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HR Management Lite: from n/a through <= 3.6.

AnalysisAI

HR Management Lite WordPress plugin versions 3.6 and earlier contain a missing authorization vulnerability allowing authenticated users to access or modify resources without proper access control checks. An attacker with low-privilege user credentials can exploit incorrectly configured access control to read or modify sensitive data within the plugin's functionality, though the vulnerability requires prior authentication and does not enable privilege escalation or system-wide impact.

Technical ContextAI

This vulnerability stems from CWE-862 (Missing Authorization), a common weakness in access control implementations where an application fails to verify that a user is authorized to perform requested actions. In the context of the HR Management Lite WordPress plugin, the access control security levels are configured incorrectly, allowing authenticated users (PR:L in CVSS vector) to bypass intended authorization restrictions. The plugin likely implements role-based or capability-based access controls that are either missing from certain endpoints or improperly validated, permitting lateral movement between user contexts or unauthorized access to HR management features. This affects the WordPress plugin ecosystem, where improper capability checks in admin AJAX handlers or REST API endpoints are a common implementation gap.

Affected ProductsAI

Weblizar HR Management Lite WordPress plugin is affected in version 3.6 and all earlier versions (from version 1.0 through 3.6). The plugin is distributed through the official WordPress.org plugin repository and available via CPE:2.3:a:weblizar:hr_management_lite:*:*:*:*:*:wordpress:*:*. The vulnerability was reported by the Patchstack security research team through their WordPress plugin vulnerability database.

RemediationAI

Update the HR Management Lite plugin to a version greater than 3.6 as soon as a patched release becomes available from Weblizar or the WordPress.org plugin repository. Administrators should check the plugin's update mechanism within the WordPress dashboard or visit the official plugin page at https://patchstack.com/database/Wordpress/Plugin/hr-management-lite/vulnerability/wordpress-hr-management-lite-plugin-3-5-broken-access-control-vulnerability?_s_id=cve for patch availability confirmation. As an interim workaround, restrict user role assignments to trusted administrators only and disable the HR Management Lite plugin entirely if it is not actively in use. WordPress site administrators should audit user accounts with elevated roles and verify access logs for unauthorized data access attempts prior to patching.