CVE-2025-62152

The ConveyThis plugin for WordPress versions 269.2 and earlier contains a missing authorization vulnerability. The plugin fails to properly check access rights, allowing exploitation of incorrectly configured access control security levels [1]. This issue is classified as a broken access control vulnerability, which can be exploited to execute higher-privileged actions.

Attackers can exploit this vulnerability over the network without authentication or with low privileges. The attack complexity is low, and no user interaction is required. This makes it possible for unauthenticated attackers to perform actions that should require administrative permissions [1].

The impact includes potential unauthorized modification of plugin settings or access to protected data. Although rated as medium severity (CVSS 5.3), such vulnerabilities are often used in mass-exploit campaigns targeting thousands of websites [1].

The vulnerability has been addressed in version 269.3 of the plugin. Users are strongly advised to update to this version or later. Patchstack users can enable auto-updates for vulnerable plugins. As an immediate action, updating the plugin is recommended to mitigate the risk [1].