PT-2025-54341 · WordPress · Wp Attachments

Jitlada · Published 2025-12-31 · Updated 2026-01-01 · CVE-2025-62888

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Marco Milesi WP Attachments versions through 5.2

Description A missing authorization issue exists in Marco Milesi WP Attachments, stemming from incorrectly configured access control security levels. This allows for potential exploitation of the system.

Recommendations Update Marco Milesi WP Attachments to a version later than 5.2.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-62888

Affected Products

Wp Attachments

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-62888 · Security Note
• https://patchstack.com/database/Wordpress/Plugin/wp-attachments/vulnerability/wordpress-wp-attachments-plugin-5-2-broken-access-control-vulnerability?_s_id=cve · Note
• https://patchstack.com/database/wordpress/plugin/wp-attachments/vulnerability/wordpress-wp-attachments-plugin-5-2-broken-access-control-vulnerability?_s_id=cve · Note
• https://twitter.com/CVEnew/status/2006736833494003762 · Twitter Post
• https://vdp.patchstack.com/database/wordpress/plugin/wp-attachments/vulnerability/wordpress-wp-attachments-plugin-5-2-broken-access-control-vulnerability?_s_id=cve · Note