PT-2025-4921 · Wc Wallet · Wc Wallet

Mika · Published 2025-02-03 · Updated 2025-02-03 · CVE-2025-23527

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions WC Wallet versions n/a through 2.2.0

Description The issue is related to a Missing Authorization vulnerability, which allows accessing functionality not properly constrained by Access Control Lists (ACLs). ACLs are used to define permissions for accessing certain resources or functionalities. In this context, the lack of proper constraints means that unauthorized access to certain functions is possible.

Recommendations For WC Wallet versions n/a through 2.2.0, consider restricting access to sensitive functionalities until a proper fix is implemented to ensure that ACLs are correctly applied to constrain access. As a temporary workaround, review and manually enforce access controls to minimize the risk of unauthorized access.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-23527

Affected Products

Wc Wallet

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-23527 · Security Note
• https://patchstack.com/database/Wordpress/Plugin/wc-wallet/vulnerability/wordpress-wc-wallet-plugin-2-2-0-arbitrary-content-deletion-vulnerability?_s_id=cve · Note
• https://twitter.com/CVEnew/status/1886427096529899527 · Twitter Post
• https://patchstack.com/database/wordpress/plugin/wc-wallet/vulnerability/wordpress-wc-wallet-plugin-2-2-0-arbitrary-content-deletion-vulnerability?_s_id=cve · Note