Access Control Vulnerability in Özgür KARALAR Kargo Takip Plugin
CVE-2026-25365

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Kargo Takip
Vendor
CVE Published:
25 March 2026

What is CVE-2026-25365?

A missing authorization issue in the Kargo Takip plugin by Özgür KARALAR allows attackers to exploit incorrectly configured access control security levels. This vulnerability primarily impacts versions prior to 0.2.4, leading to unauthorized actions within the application. It's crucial for users to update their plugin to mitigate any potential risks associated with this security flaw.

Affected Version(s)

Kargo Takip 0 <= 0.2.4

References

https://patchstack.com/database/Wordpress/Plugin/kargo-ta...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nabil Irawan | Patchstack Bug Bounty Program
.