VYPR
← All advisories
Medium severity5.3NVD Advisory· Published Jun 27, 2025· Updated Apr 23, 2026

CVE-2025-53295

CVE-2025-53295

Description

Missing Authorization vulnerability in iCount iCount Payment Gateway icount allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects iCount Payment Gateway: from n/a through <= 2.0.7.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

2

Patches

Vulnerability mechanics

Root cause

"Missing authorization checks allow unauthenticated access to plugin administrative functionality."

Attack vector

An unauthenticated remote attacker can access plugin functionality that should be restricted to authorized administrators, such as viewing or managing transactions [CWE-862]. Because no capability check is performed before processing these requests, the attacker simply sends crafted HTTP requests to the affected WordPress endpoints. The CVSS vector confirms the attack requires no authentication and is network-accessible, with a low impact on integrity.

Affected code

The iCount Payment Gateway plugin for WordPress (versions ≤ 2.0.7) fails to enforce authorization checks on administrative actions accessible through its WooCommerce integration. The plugin's admin panel and transaction management functionality can be invoked without verifying that the requesting user has the required capabilities.

What the fix does

The advisory does not include a published patch. To remediate the vulnerability, the plugin must add WordPress capability checks (e.g., `current_user_can('manage_woocommerce')` or similar) before executing any administrative action. Without such authorization checks, any unauthenticated user can invoke the plugin's restricted functionality.

Preconditions

  • configThe WordPress site must have the iCount Payment Gateway plugin (version ≤ 2.0.7) installed and activated.
  • authNo authentication or prior knowledge is required; the attacker sends HTTP requests directly to the plugin's endpoints.
  • networkThe attacker must be able to reach the WordPress site over the network.
  • inputThe attacker sends crafted HTTP requests targeting the plugin's administrative actions.

Generated on Jun 18, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

1

News mentions

0

No linked articles in our index yet.