What is the CVSS score of CVE-2026-25469?

CVE-2026-25469 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-25469?

CVE-2026-25469 presents notable security risk, a missing authorization vulnerability rated CVSS 6.5. Attackers could gain access beyond their authorized level.

How to fix or mitigate CVE-2026-25469?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

WordPress CVE-2026-25469

EUVD-2026-15753 MEDIUM

Missing Authorization (CWE-862)

2026-03-25 Patchstack

Authentication Bypass WordPress

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15753

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

MEDIUM 6.5

DescriptionCVE.org

Missing Authorization vulnerability in ViaBill for WooCommerce ViaBill – WooCommerce viabill-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ViaBill – WooCommerce: from n/a through <= 1.1.53.

AnalysisAI

The ViaBill payment gateway plugin for WooCommerce versions 1.1.53 and earlier contains an authorization bypass vulnerability that allows unauthenticated attackers to manipulate access controls. An attacker can exploit this misconfiguration to modify transaction data or disrupt payment processing on affected WordPress stores. No patch is currently available for this vulnerability.

Technical ContextAI

The vulnerability resides in the ViaBill for WooCommerce plugin (CPE: cpe:2.3:a:viabill_for_woocommerce:viabill_woocommerce), a WordPress payment gateway integration extension. The root cause is classified under CWE-862 (Missing Authorization), which occurs when access control checks are absent or improperly enforced on sensitive operations. In the context of WordPress plugins, this typically manifests as missing capability checks (e.g., wp-nonce validation or user role verification) on administrative or settings-modification endpoints, allowing unauthorized actors to invoke privileged functionality through direct HTTP requests or form manipulation.

RemediationAI

Immediately upgrade the ViaBill for WooCommerce plugin to the patched version released after 1.1.53; check the official ViaBill or WordPress plugin repository for the latest available version. Until patching is completed, restrict administrative access to WordPress by implementing IP whitelisting on wp-admin endpoints, enforce strong authentication via two-factor authentication (2FA), and disable direct access to plugin settings endpoints if possible. Monitor WordPress audit logs for unauthorized settings changes and review ViaBill payment configuration history for tampering. Consult the Patchstack advisory for specific patch details and timeline.