What is the CVSS score of EUVD-2025-19863?

EUVD-2025-19863 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.1%.

Which versions of Melapress File Monitor are affected by EUVD-2025-19863?

Organizations using Missing Authorization vulnerability in Melapress Melapress File Monitor should be aware of moderate risk from CVE-2025-3702, a missing authorization vulnerability rated CVSS 5.4.. A patch is available.

How to fix or mitigate EUVD-2025-19863?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Melapress File Monitor EUVD-2025-19863

| CVE-2025-3702 MEDIUM

Missing Authorization (CWE-862)

2025-07-03 audit@patchstack.com

WordPress Authentication Bypass Melapress File Monitor Wordpress Plugin Melapress

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

5.4 MEDIUM

Low-privilege authenticated user, network access, no user interaction; integrity and availability impacts limited to plugin data.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

2.2.0

EUVD ID Assigned

Mar 16, 2026 - 02:12 euvd

EUVD-2025-19863

Analysis Generated

Mar 16, 2026 - 02:12 vuln.today

CVE Published

Jul 03, 2025 - 13:15 nvd

MEDIUM 5.4

DescriptionCVE.org

Missing Authorization vulnerability in Melapress Melapress File Monitor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Melapress File Monitor: from n/a before 2.2.0.

AnalysisAI

In Melapress File Monitor plugin for WordPress before 2.2.0, missing authorization checks allow authenticated attackers to exploit incorrectly configured access control, potentially leading to unauthorized modification of integrity or availability of monitored data. The vulnerability carries a CVSS 3.1 base score of 5.4 (medium) and has a low EPSS exploitation probability (0.06%), with no known active exploitation or public exploit code. A vendor patch in version 2.2.0 addresses the issue.

Technical ContextAI

The vulnerability resides in the access control implementation of the Melapress File Monitor WordPress plugin (cpe:2.3:a:melapress:melapress_file_monitor). CWE-862 (Missing Authorization) indicates that the plugin fails to properly verify user permissions when performing certain actions, allowing lower-privileged authenticated users to bypass intended security restrictions. The plugin's functionality, which monitors file changes on a WordPress site, becomes vulnerable when such authorization checks are omitted, enabling unauthorized manipulation of the monitoring data or settings.

RemediationAI

Upgrade to Melapress File Monitor version 2.2.0 or later, which fixes the missing authorization flaw. If immediate patching is not possible, restrict WordPress user roles to only trusted accounts and audit plugin permissions; note that limiting roles may reduce file monitoring functionality for legitimate users. Vendor advisory: https://patchstack.com/database/wordpress/plugin/website-file-changes-monitor/vulnerability/wordpress-melapress-file-monitor-plugin-2-2-0-broken-access-control-vulnerability.