CVE-2025-23761

WordPress Woo Tuner plugin <= 0.1.2 - Broken Access Control vulnerability

View on CVE.org
Published Jan 16, 2025 CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Description
Missing Authorization vulnerability in Alex Volkov Woo Tuner allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Woo Tuner: from n/a through 0.1.2.

Analysis

AI-generated

Technical impact

Missing authorization in Woo Tuner allows attackers to bypass configured access control levels, potentially enabling unauthorized operations. This flaw is classified under CWE-862.

Affected Systems

The vulnerability affects the Woo Tuner plugin by Alex Volkov distributed for WordPress, for all releases up to and including version 0.1.2. Site administrators using this plugin should verify their installed version.

Risk and Exploitability

The CVSS score is 5.4 indicating moderate severity, and the EPSS score is less than 1 %, indicating low exploitation probability at this time. This vulnerability is not listed in the CISA KEV catalog. The likely attack vector, based on the description, is a web-based request to the plugin’s administrative interface. Exploitation would allow an attacker to perform unauthorized actions if any user can access those endpoints.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Woo Tuner to the latest available version that includes the access-control fix.
  • If an immediate upgrade is not possible, disable or uninstall Woo Tuner until a patched version is released.
  • Revise user permission settings to minimize capabilities for users that interact with the plugin’s administration pages.

Generated by OpenCVE AI on May 2, 2026 at 05:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2025-3397 Missing Authorization vulnerability in Alex Volkov Woo Tuner allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Woo Tuner: from n/a through 0.1.2.
History
Type Values Removed Values Added
Description Missing Authorization vulnerability in Alex Volkov Woo Tuner woo-tuner allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Woo Tuner: from n/a through <= 0.1.2. Missing Authorization vulnerability in Alex Volkov Woo Tuner allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Woo Tuner: from n/a through 0.1.2.
References
Type Values Removed Values Added
Description Missing Authorization vulnerability in Alex Volkov Woo Tuner allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Woo Tuner: from n/a through 0.1.2. Missing Authorization vulnerability in Alex Volkov Woo Tuner woo-tuner allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Woo Tuner: from n/a through <= 0.1.2.
References
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Missing Authorization vulnerability in Alex Volkov Woo Tuner allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Woo Tuner: from n/a through 0.1.2.
Title WordPress Woo Tuner plugin <= 0.1.2 - Broken Access Control vulnerability
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L'}
Earlier changes (1)

Subscriptions

No data.

Weaknesses

Sources

Status
PUBLISHED
Assigner
Patchstack
Published
Updated
Apr 28, 2026, 4:11 PM
Reserved
Jan 16, 2025, 11:29 AM

View source JSON

Updated
Jan 17, 2025, 5:35 PM

JSON

Status
Deferred
Published
Jan 16, 2025, 9:15 PM
Modified
Jun 17, 2026, 8:56 AM

View source JSON

No data.

Updated
May 2, 2026, 6:00 AM

JSON