CVE-2025-58877CWE-862

WordPress Javo Core plugin <= 3.0.0.529 - Arbitrary Content Deletion vulnerability

High · published December 18, 2025

CVSS v3.1
7.5
EPSS
0%
Percentile
29.9
In the wild
Unconfirmed
What it is

⚡ A missing authorization check in Javo Core opens the door wide for unauthorized access! 🚪🙈 Think of it like a VIP club where the bouncer forgot to check IDs — anyone could walk in and access the exclusive lounge without proper clearance. An attacker could exploit this vulnerability to access restricted areas, steal sensitive information, or manipulate data without ever needing a password. It's a recipe for chaos that could leave your users and your reputation in shambles!

Put simply

Think of it like a VIP club where the bouncer forgot to check IDs — anyone could walk in and access the exclusive lounge without proper clearance. This vulnerability arises from incorrectly configured access control security levels, allowing users to perform actions that should be restricted to authorized personnel only.

What to do

An attacker could exploit this vulnerability to access restricted areas, steal sensitive information, or manipulate data without ever needing a password. It's a recipe for chaos that could leave your users and your reputation in shambles! Upgrade Javo Core to the latest version (beyond 3.0.0.529) to ensure proper authorization checks are in place. Conduct a thorough audit of your access control settings to tighten security across the board. Don't forget to review user permissions for all roles! You've got this! Tackle these updates head-on and bolster your security! 🛡️

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00372 · 29.9th percentile
Weakness
CWE-862 · Missing Authorization
Published
2025-12-18T07:21Z
EPSS history
Timeline
  • 18 DEC 07:21Z
    WordPress Javo Core plugin <= 3.0.0.529 - Arbitrary Content Deletion vulnerability
    cvelistv5