Access Control Weakness in Ksher Payment Plugin
CVE-2025-22730

6.5MEDIUM

Key Information:

Vendor
Ksher
Status
Ksher
Vendor
CVE Published:
4 February 2025

Summary

The Ksher Payment Plugin suffers from a missing authorization vulnerability that allows unauthorized users to exploit incorrectly configured access control security levels. This flaw compromises the integrity of the plugin, potentially enabling malicious actors to gain unauthorized access to sensitive functionalities and data. Users of the Ksher Payment Plugin version 1.1.2 and earlier should take immediate steps to investigate and address this vulnerability to safeguard their systems against potential exploitation.

Affected Version(s)

Ksher <= 1.1.2

References

https://patchstack.com/database/wordpress/plugin/ksher-pa...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mika (Patchstack Alliance)
.