CVE-2025-62919CWE-862broken-access-control

CVE-2025-62919

Medium · published October 27, 2025

CVSS v3.1
5.4
EPSS
0%
Percentile
19.3
In the wild
Unconfirmed
What it is

⚠️ A missing authorization check in the TS Demo Importer could let anyone sneak in and access restricted areas — it's like giving a visitor a master key they shouldn't have! 🔑 Think of it like a hotel reception desk that mistakenly hands out room keys without checking if the guest is actually registered. Anyone could stroll into any room, even those marked as off-limits! If an attacker exploits this vulnerability, they could access sensitive functionalities without proper authorization. This could lead to unauthorized data changes or exposure of private information, potentially causing a headache you didn’t sign up for!

Put simply

Think of it like a hotel reception desk that mistakenly hands out room keys without checking if the guest is actually registered. Anyone could stroll into any room, even those marked as off-limits! This missing authorization vulnerability in the TS Demo Importer allows unauthorized users to bypass security levels, leading to incorrect access control and potential misuse of the importer’s features.

What to do

If an attacker exploits this vulnerability, they could access sensitive functionalities without proper authorization. This could lead to unauthorized data changes or exposure of private information, potentially causing a headache you didn’t sign up for! To shore up your defenses, ensure you update to the latest version of TS Demo Importer — at least beyond 0.1.3. Implement strict access control checks and review your current configurations to make sure everything aligns with best security practices. You've got this! With these actions, you’ll be back in control and ready to protect your valuable data! 🛡️

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00278 · 19.3th percentile
Weakness
CWE-862 · Missing Authorization
Published
2025-10-27T06:15Z
References (1)
EPSS history
Timeline
  • 27 OCT 01:33Z
    WordPress TS Demo Importer plugin <= 0.1.3 - Broken Access Control vulnerability
    cvelistv5