CVE-2025-63023

Vulnerability

The plugin suffers from a missing authorization check (broken access control) in its access control security levels. This flaw allows unprivileged users to perform actions that should require higher privileges, potentially leading to unauthorized operations. The issue affects versions from n/a through 9.0.53 [1].

Exploitation

An attacker can exploit this vulnerability by sending specially crafted requests to the WordPress site. No authentication is required, and the attack can be executed remotely. The vulnerability is known to be used in mass-exploit campaigns, targeting thousands of websites regardless of their size or popularity [1].

Impact

Successful exploitation could allow an attacker to execute actions intended for higher-privileged users, such as modifying plugin settings or accessing sensitive payment data. The CVSS score is 5.3 (Medium), indicating a moderate risk [1].

Mitigation

The vendor has released version 9.0.54 which fixes the issue. Users are strongly advised to update immediately. If auto-update is enabled, Patchstack users can turn it on for vulnerable plugins. No workarounds are explicitly mentioned [1].