Missing Authorization Vulnerability in Vikas Ratudi VPSUForm
CVE-2025-58957

4.3MEDIUM

Key Information:

Vendor

WordPress
Status
Vpsuform
Vendor
CVE Published:
22 September 2025

What is CVE-2025-58957?

The VPSUForm plugin by Vikas Ratudi contains a missing authorization vulnerability that allows for the exploitation of incorrectly configured access control security levels. This can lead to unauthorized access, with potential impacts on the security and integrity of data managed through the plugin. Users of VPSUForm should update to the latest version (3.2.20) to mitigate this issue.

Affected Version(s)

VPSUForm <= 3.2.20

References

https://patchstack.com/database/wordpress/plugin/v-form/v...
vdb-entry

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Legion Hunter (Patchstack Alliance)
.
CVE-2025-58957 : Missing Authorization Vulnerability in Vikas Ratudi VPSUForm