What is the CVSS score of CVE-2025-69024?

CVE-2025-69024 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

BizPrint CVE-2025-69024

Q: Which versions of BizPrint are affected by CVE-2025-69024?

Unauthorized information disclosure in BizPrint plugin for WooCommerce allows authenticated attackers with low privileges to read sensitive data via a network request.

MEDIUM

Missing Authorization (CWE-862)

2025-12-30 audit@patchstack.com

WordPress Authentication Bypass Google

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Remote attacker with low privileges can read sensitive data without user interaction; confidentiality impact high.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 15:47 vuln.today

CVE Published

Dec 30, 2025 - 11:16 cve.org

MEDIUM 6.5

DescriptionCVE.org

Missing Authorization vulnerability in bizswoop BizPrint print-google-cloud-print-gcp-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BizPrint: from n/a through <= 4.6.7.

AnalysisAI

Unauthorized information disclosure in BizPrint plugin for WooCommerce allows authenticated attackers with low privileges to read sensitive data via a network request. The vulnerability stems from a missing authorization check (CWE-862) in versions up to and including 4.6.7, exposing data such as order or customer information. No active exploitation or public exploit code has been identified, and EPSS indicates a very low probability (0.04%) of widespread exploitation.

Technical ContextAI

The BizPrint plugin (print-google-cloud-print-gcp-woocommerce) integrates WooCommerce with Google Cloud Print, handling print job data and potentially associated order or customer details. CWE-862 indicates a missing authorization check on an accessible endpoint, likely a REST API route or admin-ajax action that fails to verify user capabilities. The CVSS vector (AV:N/AC:L/PR:L/UI:N) shows the attack is network-based, low complexity, and requires only low privileges, suggesting any authenticated user (e.g., subscriber) can trigger the flaw. The affected CPE would be the WordPress plugin slug, which aligns with the Patchstack advisory reference.

Affected ProductsAI

The vulnerability affects BizPrint plugin for WordPress versions from n/a through 4.6.7. The vendor advisory is hosted on Patchstack at https://patchstack.com/database/Wordpress/Plugin/print-google-cloud-print-gcp-woocommerce/vulnerability/wordpress-bizprint-plugin-4-6-7-broken-access-control-vulnerability?_s_id=cve. CPE strings are not explicitly provided, but the product slug is print-google-cloud-print-gcp-woocommerce.

RemediationAI

Update the BizPrint plugin to a version later than 4.6.7 immediately. Refer to the Patchstack advisory for the exact fixed version, as patch details are not confirmed in this dataset. If a patch is not yet available, mitigate by restricting access to the plugin’s REST endpoints or admin_ajax actions via web server rules (e.g., Apache .htaccess or nginx location blocks) or a web application firewall, though this may break plugin functionality that legitimately requires access. Regularly monitor the Patchstack advisory for updates.