Access Control Flaw in EnvoThemes Envo Extra WordPress Plugin
CVE-2025-47471

4.3MEDIUM

Key Information:

Vendor

WordPress
Status
Envo Extra
Vendor
CVE Published:
7 May 2025

What is CVE-2025-47471?

A vulnerability in EnvoThemes Envo Extra allows unauthorized access due to incorrectly configured access control security levels. This issue can allow attackers to exploit the application and gain access to sensitive functionalities that should be restricted. It affects several versions, including those from n/a up to 1.9.9, making it crucial for site administrators to evaluate their plugin settings and ensure they are configured securely.

Affected Version(s)

Envo Extra <= 1.9.9

References

https://patchstack.com/database/wordpress/plugin/envo-ext...
vdb-entry

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

domiee13 (Patchstack Alliance)
.