CVE-2025-24762: 
WordPress vulnerability analysis and mitigation

A Missing Authorization vulnerability was discovered in facturaone TicketBAI Facturas para WooCommerce plugin through version 3.19. The vulnerability was disclosed on June 6, 2025, and is tracked as CVE-2025-24762. The issue allows exploiting incorrectly configured access control security levels in the WordPress plugin (Patchstack).

The vulnerability is classified as a Missing Authorization issue (CWE-862) with a CVSS v3.1 Base Score of 5.4 (Medium). The attack vector is network-based (AV:N) with low attack complexity (AC:L), requiring low privileges (PR:L) and no user interaction (UI:N). The scope is unchanged (S:U) with low impacts to integrity and availability (I:L, A:L) and no impact to confidentiality (C:N) (NVD).

The vulnerability allows unauthorized users to exploit incorrectly configured access control security levels. This could potentially lead to unauthorized access to protected functionality within the WooCommerce plugin (Patchstack).

The vulnerability is considered to have low severity impact and is unlikely to be exploited. It can be triggered by unauthenticated users, though specific exploit conditions are not publicly detailed (Patchstack).

As of the disclosure date, no official fix is available for versions through 3.19. The vulnerability was reported by security researcher ch4r0n on April 29, 2025, and published by Patchstack on June 5, 2025 (Patchstack).