What is the CVSS score of EUVD-2026-15687?

EUVD-2026-15687 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Kargo Takip are affected by EUVD-2026-15687?

CVE-2026-25365 presents notable security risk, a missing authorization vulnerability rated CVSS 6.5. Attackers could gain access beyond their authorized level.. A patch is available.

How to fix or mitigate EUVD-2026-15687?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Kargo Takip EUVD-2026-15687

| CVE-2026-25365 MEDIUM

Missing Authorization (CWE-862)

2026-03-25 Patchstack

GHSA-c33c-vr44-685c

Authentication Bypass Kargo Takip

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

0.2.4

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15687

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

MEDIUM 6.5

DescriptionCVE.org

Missing Authorization vulnerability in Özgür KARALAR Kargo Takip kargo-takip-turkiye allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kargo Takip: from n/a through < 0.2.4.

AnalysisAI

Kargo Takip versions prior to 0.2.4 contain a missing authorization vulnerability that allows authenticated users to modify data or perform unauthorized actions due to improper access control enforcement. An attacker with valid credentials could exploit this weakness to manipulate shipment tracking information or other protected resources without proper privilege verification. No patch is currently available for this vulnerability.

Technical ContextAI

The Kargo Takip plugin (CPE: cpe:2.3:a:özgür_karalar:kargo_takip:*:*:*:*:*:*:*:*) is a WordPress plugin designed for Turkish cargo tracking services. The vulnerability stems from CWE-862 (Missing Authorization), which indicates the application fails to enforce proper access control checks before allowing users to access sensitive functions or data. The root cause involves misconfigured security levels in the plugin's access control implementation, likely affecting REST API endpoints, admin functions, or core cargo tracking features that should be restricted to authenticated and authorized users. The plugin's architecture does not properly validate user permissions before granting access to protected resources.

RemediationAI

Immediately upgrade the Kargo Takip plugin to version 0.2.4 or later from the official WordPress plugin repository or the vendor's distribution channel. See the Patchstack vulnerability report at https://patchstack.com/database/Wordpress/Plugin/kargo-takip-turkiye/vulnerability/wordpress-kargo-takip-plugin-0-2-4-broken-access-control-vulnerability for detailed patch information. If immediate patching is not possible, implement temporary mitigations by restricting access to the plugin's admin pages via web application firewall (WAF) rules, disabling the plugin entirely until patching is feasible, or restricting access to the WordPress installation to trusted IP ranges only. Review WordPress user roles and capabilities to ensure only authenticated, properly-privileged users have access to cargo tracking functionality.