CVE-2025-62980CWE-862broken-access-control

CVE-2025-62980

Medium · published October 27, 2025

CVSS v3.1
5.4
EPSS
0%
Percentile
11.4
In the wild
Unconfirmed
What it is

⚠️ A surprisingly sneaky missing authorization vulnerability lurks in MDZ Persian Admin Fonts, letting folks sneak in where they shouldn’t! Picture a busy restaurant with a mysterious backdoor that nobody checks — this vulnerability allows unauthorized users to waltz right in, bypassing normal security checks like a phantom patron slipping past the bouncers! If exploited, an attacker could access sensitive information or actions they shouldn’t have permission for, potentially leading to unauthorized changes or data leaks. While it’s not the worst-case scenario, this could lead to a frustrating mess for admins trying to keep things secure!

Put simply

Picture a busy restaurant with a mysterious backdoor that nobody checks — this vulnerability allows unauthorized users to waltz right in, bypassing normal security checks like a phantom patron slipping past the bouncers! This vulnerability stems from incorrectly configured access control security levels, allowing users to bypass authorization checks in versions of MDZ Persian Admin Fonts up to and including 4.1.03.

What to do

If exploited, an attacker could access sensitive information or actions they shouldn’t have permission for, potentially leading to unauthorized changes or data leaks. While it’s not the worst-case scenario, this could lead to a frustrating mess for admins trying to keep things secure! To secure your system, update to the latest version of MDZ Persian Admin Fonts and conduct a review of your access control settings. Make sure to apply best practices for user permissions to avoid any uninvited guests! You've got this! Follow these steps, and you’ll have your security back on track in no time! 🛡️

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00216 · 11.4th percentile
Weakness
CWE-862 · Missing Authorization
Published
2025-10-27T06:15Z
References (1)
EPSS history
Timeline
  • 27 OCT 01:34Z
    WordPress Persian Admnin Fonts plugin <= 4.1.03 - Broken Access Control vulnerability
    cvelistv5