What is the CVSS score of EUVD-2025-17515?

EUVD-2025-17515 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H. EPSS exploitation probability: 0.1%.

Which versions of WordPress are affected by EUVD-2025-17515?

A missing authorization vulnerability in the Stock Locations for WooCommerce plugin (versions through 2.8.6) could allow attackers to bypass access controls and manipulate inventory data without…

How to fix or mitigate EUVD-2025-17515?

Within 24 hours: Audit active installations of Stock Locations for WooCommerce and document version numbers; disable the plugin if version 2.8.6 or earlier is detected. Within 7 days: Identify alternative inventory management solutions or contact the vendor for timeline on patch availability; implement network-level monitoring for suspicious access patterns to the plugin endpoints. Within 30 days: Deploy the vendor patch immediately upon release; conduct access control audit across all WooCommerce inventory features; review logs for potential unauthorized access during the vulnerability window.

WordPress EUVD-2025-17515

| CVE-2025-47463 HIGH

Missing Authorization (CWE-862)

2025-06-09 audit@patchstack.com

WordPress Authentication Bypass

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

EUVD ID Assigned

Mar 14, 2026 - 19:21 euvd

EUVD-2025-17515

Analysis Generated

Mar 14, 2026 - 19:21 vuln.today

CVE Published

Jun 09, 2025 - 16:15 nvd

HIGH 7.1

DescriptionCVE.org

Missing Authorization vulnerability in Fahad Mahmood Stock Locations for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Stock Locations for WooCommerce: from n/a through 2.8.6.

AnalysisAI

Missing Authorization vulnerability in Fahad Mahmood's Stock Locations for WooCommerce plugin (versions up to 2.8.6) that allows authenticated users with low privileges to perform unauthorized actions including information disclosure and availability disruption. An attacker with basic user credentials can bypass access controls to modify stock locations or trigger denial-of-service conditions due to improper privilege verification. This vulnerability has a CVSS score of 7.1 (High) and affects WooCommerce installations using the vulnerable plugin; KEV status and active exploitation data are not currently confirmed in public advisories.

Technical ContextAI

The vulnerability exists in the Stock Locations for WooCommerce plugin, which extends WooCommerce's e-commerce functionality to manage inventory across multiple warehouse or storage locations. The root cause is CWE-862 (Missing Authorization), indicating the plugin fails to properly enforce role-based access control (RBAC) checks before executing sensitive operations. Rather than verifying user capabilities via WordPress's capability system (e.g., manage_woocommerce, edit_products), the plugin likely exposes administrative or restricted endpoints to authenticated users without sufficient privilege validation. This affects the plugin across all versions from the initial release through version 2.8.6, with the vulnerability residing in action handlers, AJAX endpoints, or REST API routes that interact with stock location data. CPE identifier would be: cpe:2.3:a:fahad_mahmood:stock_locations_for_woocommerce:*:*:*:*:*:wordpress:*:* (versions <=2.8.6).