PT-2025-49873 · Elastic · Email Sender

Published 2025-12-09 · Updated 2025-12-15 · CVE-2025-66525

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Elastic Email Sender versions through 1.2.20

Description An issue exists in Elastic Email Sender related to incorrectly configured access control security levels, potentially allowing unauthorized access. The vulnerability involves a missing authorization check.

Recommendations Update Elastic Email Sender to a version later than 1.2.20.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-66525

Affected Products

Email Sender

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-66525 · Security Note
• https://patchstack.com/database/Wordpress/Plugin/elastic-email-sender/vulnerability/wordpress-elastic-email-sender-plugin-1-2-20-broken-access-control-vulnerability?_s_id=cve · Note
• https://twitter.com/CVEnew/status/2000617595670573454 · Twitter Post
• https://vdp.patchstack.com/database/Wordpress/Plugin/elastic-email-sender/vulnerability/wordpress-elastic-email-sender-plugin-1-2-20-broken-access-control-vulnerability?_s_id=cve · Note