CVE-2025-53214CWE-862broken-access-control

CVE-2025-53214

Medium · published November 6, 2025

CVSS v3.1
6.5
EPSS
0%
Percentile
10.6
In the wild
Unconfirmed
What it is

⚠️ A missing authorization vulnerability could let anyone stroll right into restricted areas of your Sertifier Certificate & Badge Maker! Think of it like a hotel where guests can wander into any room without showing a keycard — you might find some very private documents just lying around! This flaw allows unauthorized users to access sensitive certificates and badges, potentially leading to significant security breaches. If left unaddressed, someone could exploit this gap to misrepresent credentials or gain access to privileged information.

Put simply

Think of it like a hotel where guests can wander into any room without showing a keycard — you might find some very private documents just lying around! The issue lies in incorrectly configured access controls, which fail to properly verify user permissions. This means that unauthorized users can gain access to functions and data they shouldn't be able to see.

What to do

This flaw allows unauthorized users to access sensitive certificates and badges, potentially leading to significant security breaches. If left unaddressed, someone could exploit this gap to misrepresent credentials or gain access to privileged information. To mitigate this vulnerability, ensure you update Sertifier Certificate & Badge Maker to version 1.22 or later. Additionally, review and correctly configure your access control settings to guarantee only authorized users can access sensitive areas of the application. You've got this! Patch up and secure your Certificate & Badge Maker like a pro! 🛡️

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00210 · 10.6th percentile
Weakness
CWE-862 · Missing Authorization
Published
2025-11-06T21:15Z
References (1)
EPSS history
Timeline
  • 06 NOV 15:53Z
    WordPress Sertifier Certificate & Badge Maker plugin <= 1.21 - Broken Access Control Vulnerability
    cvelistv5