What is the CVSS score of CVE-2026-25455?

CVE-2026-25455 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-25455?

CVE-2026-25455 presents notable security risk, a missing authorization vulnerability rated CVSS 6.5. Attackers could gain access beyond their authorized level.

How to fix or mitigate CVE-2026-25455?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

WordPress CVE-2026-25455

EUVD-2026-15734 MEDIUM

Missing Authorization (CWE-862)

2026-03-25 Patchstack

GHSA-5495-mp9j-58j3

WordPress Authentication Bypass

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15734

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

MEDIUM 6.5

DescriptionCVE.org

Missing Authorization vulnerability in PickPlugins Product Slider for WooCommerce woocommerce-products-slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Slider for WooCommerce: from n/a through <= 1.13.60.

AnalysisAI

Authenticated users can bypass authorization checks in PickPlugins Product Slider for WooCommerce version 1.13.60 and earlier due to improper access control, allowing them to modify product slider configurations they should not have permission to alter. This vulnerability requires valid WordPress credentials but no additional user interaction, affecting all installations of the vulnerable plugin. A patch is not currently available.

Technical ContextAI

Product Slider for WooCommerce is a WordPress plugin (CPE: cpe:2.3:a:pickplugins:product_slider_for_woocommerce:*:*:*:*:*:*:*:*) designed to display WooCommerce product catalogs dynamically. The vulnerability is classified as CWE-862 (Missing Authorization), which occurs when an application fails to implement proper access control checks before allowing users to perform sensitive operations. In the context of a WordPress plugin, this typically means the plugin does not adequately verify user roles, capabilities, or nonces before executing critical functions such as creating, modifying, or deleting product slider configurations. WordPress plugins that interact with WooCommerce data or admin settings without proper authorization checks are particularly susceptible to this class of vulnerability, as attackers with low-privilege accounts (or even unauthenticated users, depending on the affected function) may gain unintended access to administrative features.

RemediationAI

Immediately upgrade Product Slider for WooCommerce to a version newer than 1.13.60, when available. Consult the official PickPlugins website or the WooCommerce plugin repository for the latest patched release and installation instructions. Until an upgrade is feasible, implement the following interim controls: (1) restrict plugin functionality by removing user roles or capabilities that should not have access to slider configuration via WordPress user management; (2) use a Web Application Firewall (WAF) rule to block requests to the affected plugin's administrative endpoints if they originate from untrusted sources; (3) monitor WordPress admin logs and database modifications for unauthorized slider or product configuration changes; (4) if the plugin is not actively used, consider temporarily deactivating it until a patch is deployed. For detailed patching guidance and vendor advisories, refer to the Patchstack reference at https://patchstack.com/database/Wordpress/Plugin/woocommerce-products-slider/vulnerability/wordpress-product-slider-for-woocommerce-plugin-1-13-60-broken-access-control-vulnerability.