CVE-2025-62007CWE-266

CVE-2025-62007

High · published October 22, 2025

CVSS v3.1
8.8
EPSS
0%
Percentile
30.7
In the wild
Unconfirmed
What it is

⚡ A sneaky privilege escalation flaw in bPlugins Voice Feedback could let a user climb the ranks in all the wrong ways! 🔥 Think of it like a restaurant where the waitstaff can suddenly access the manager’s office just because they found a poorly locked door. One wrong move, and they could change the menu, access sensitive info, or even alter the staff schedule. An attacker could exploit this vulnerability to gain higher privileges, potentially allowing them to alter settings or access sensitive data, leading to a total breakdown of trust. Imagine a rogue employee with full access — it could be absolutely devastating for any organization!

Put simply

Think of it like a restaurant where the waitstaff can suddenly access the manager’s office just because they found a poorly locked door. One wrong move, and they could change the menu, access sensitive info, or even alter the staff schedule. This vulnerability arises from incorrect privilege assignment in the Voice Feedback plugin, allowing unauthorized users to elevate their privileges and perform actions they normally wouldn’t be allowed to do.

What to do

An attacker could exploit this vulnerability to gain higher privileges, potentially allowing them to alter settings or access sensitive data, leading to a total breakdown of trust. Imagine a rogue employee with full access — it could be absolutely devastating for any organization! Update to version 1.0.4 or later immediately to patch this vulnerability. It's also a good idea to conduct an audit of user permissions to ensure that no unauthorized accesses have occurred. Stay vigilant! You've got this! Follow these steps and you’ll be on your way to securing your system in no time! 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00380 · 30.7th percentile
Weakness
CWE-266 · Incorrect Privilege Assignment
Published
2025-10-22T19:16Z
References (1)
EPSS history
Timeline
  • 22 OCT 14:32Z
    WordPress Voice Feedback plugin <= 1.0.3 - Privilege Escalation vulnerability
    cvelistv5