Description
Missing Authorization vulnerability in WP Grids EasyTest – Simplify A/B Testing convertpro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EasyTest – Simplify A/B Testing: from n/a through 1.0.1.
Published: 2025-12-31
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Access
Action: Immediate Patch
AI Analysis

Impact

This missing authorization vulnerability, classified as CWE-862 (Broken Access Control), is present in WP Grids EasyTest plugin, allowing attackers to exploit incorrectly configured access control security levels. The issue affects EasyTest from n/a through 1.0.1.

Affected Systems

The vulnerability targets the WP Grids EasyTest plugin, affecting all releases from the earliest version up to and including 1.0.1.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The issue is not listed in the CISA KEV catalog. Attackers can likely exploit the flaw by sending unauthenticated or mis‑authenticated HTTP requests to the plugin’s protected endpoints. Because the problem is a broken access control, success requires the attacker to reach the vulnerable functionality, implying that clients exposed to the public web face some risk.

Generated by OpenCVE AI on October 28, 2026 at 15:02 UTC.

Remediation

Vendor Solution

Update the WordPress EasyTest – Simplify A/B Testing plugin to the latest available version (at least 1.0.2).

OpenCVE Recommended Actions

  • Upgrade the EasyTest plugin to a version newer than 1.0.1 or remove the plugin entirely if it is no longer needed.
  • If upgrading is not feasible, enforce manual access control by configuring the site to deny plugin execution to non‑administrative accounts or by disabling the plugin in the WordPress admin panel for unauthenticated users.
  • Monitor site logs for anomalous use of EasyTest endpoints and for repeated unauthorized access attempts.

Generated by OpenCVE AI on October 28, 2026 at 15:02 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 28 Oct 2026 13:45:00 +0000

Type Values Removed Values Added
Description Missing Authorization vulnerability in Brainstorm Force Convert Pro convertpro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Convert Pro: from n/a through 1.0.1. Missing Authorization vulnerability in WP Grids EasyTest – Simplify A/B Testing convertpro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EasyTest – Simplify A/B Testing: from n/a through 1.0.1.
Title WordPress Convert Pro plugin <= 1.0.1 - Broken Access Control vulnerability WordPress EasyTest – Simplify A/B Testing plugin <= 1.0.1 - Broken Access Control vulnerability

Wed, 28 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
References

Wed, 28 Oct 2026 13:15:00 +0000

Type Values Removed Values Added
Description Missing Authorization vulnerability in WP Grids EasyTest convertpro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EasyTest: from n/a through <= 1.0.1. Missing Authorization vulnerability in Brainstorm Force Convert Pro convertpro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Convert Pro: from n/a through 1.0.1.
Title WordPress EasyTest plugin <= 1.0.1 - Broken Access Control vulnerability WordPress Convert Pro plugin <= 1.0.1 - Broken Access Control vulnerability
References

Thu, 23 Apr 2026 15:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}

Wed, 01 Apr 2026 23:45:00 +0000

Type Values Removed Values Added
Description Missing Authorization vulnerability in WP Grids EasyTest allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EasyTest: from n/a through 1.0.1. Missing Authorization vulnerability in WP Grids EasyTest convertpro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EasyTest: from n/a through <= 1.0.1.
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}

Tue, 20 Jan 2026 15:30:00 +0000

Type Values Removed Values Added
References

Tue, 20 Jan 2026 14:45:00 +0000

Type Values Removed Values Added
References

Mon, 05 Jan 2026 10:45:00 +0000

Type Values Removed Values Added
First Time appeared Wordpress
Wordpress wordpress
Vendors & Products Wordpress
Wordpress wordpress

Wed, 31 Dec 2025 17:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 31 Dec 2025 15:15:00 +0000

Type Values Removed Values Added
Description Missing Authorization vulnerability in WP Grids EasyTest allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EasyTest: from n/a through 1.0.1.
Title WordPress EasyTest plugin <= 1.0.1 - Broken Access Control vulnerability
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}

Subscriptions

Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-10-28T13:39:33.266Z

Reserved: 2025-10-24T14:25:50.121Z

Link: CVE-2025-63031

cve-icon Vulnrichment

Updated: 2025-12-31T16:51:22.536Z

cve-icon NVD

Status : Deferred

Published: 2025-12-31T15:15:54.320

Modified: 2026-10-28T14:16:55.940

Link: CVE-2025-63031

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-28T15:15:14Z

Weaknesses