What is the CVSS score of EUVD-2025-20011?

EUVD-2025-20011 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.1%.

Which versions of MF Plus WPML are affected by EUVD-2025-20011?

Organizations using Missing Authorization vulnerability in Gnuget MF Plus WPML should be aware of notable risk from CVE-2025-49431, a missing authorization vulnerability rated CVSS 6.5.

How to fix or mitigate EUVD-2025-20011?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

MF Plus WPML EUVD-2025-20011

| CVE-2025-49431 MEDIUM

Missing Authorization (CWE-862)

2025-07-04 audit@patchstack.com

WordPress Authentication Bypass Wordpress Plugin

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

6.5 MEDIUM

Network-accessible endpoint without authentication; limited to integrity and availability impacts.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 16, 2026 - 02:42 euvd

EUVD-2025-20011

Analysis Generated

Mar 16, 2026 - 02:42 vuln.today

CVE Published

Jul 04, 2025 - 12:15 nvd

MEDIUM 6.5

DescriptionCVE.org

Missing Authorization vulnerability in Gnuget MF Plus WPML allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects MF Plus WPML: from n/a through 1.1.

AnalysisAI

Missing authorization in Gnuget MF Plus WPML plugin versions up to 1.1 allows unauthenticated attackers to modify settings. The vulnerability has a CVSS base score of 6.5, affecting integrity and availability without confidentiality impact, but no active exploitation is known and EPSS score (0.06%) indicates a low probability of real-world attacks.

Technical ContextAI

The flaw is caused by missing authorization checks (CWE-862) in a WordPress plugin endpoint, likely an AJAX or REST route that fails to verify user capabilities before allowing settings modifications. The affected product is the MF Plus WPML plugin for WordPress, identified by the vendor Gnuget. CPE data is not included in the NVD record, but the product would map to cpe:2.3:a:gnuget:mf_plus_wpml:*:*:*:*:*:wordpress:*:*. The underlying technology is PHP-based WordPress plugin architecture.

RemediationAI

No specific patch version is identified in the available data; the Patchstack advisory should be checked for fix details. As a workaround, disable the plugin until an update is released, which eliminates the vulnerability but breaks any functionality depending on the plugin. Alternatively, monitor plugin settings for unauthorized changes and restrict public access to WordPress admin areas.