CVE-2025-49998: 
WordPress vulnerability analysis and mitigation

CVE-2025-49998 is a Missing Authorization vulnerability discovered in the Wetail WooCommerce Fortnox Integration plugin affecting versions through 4.5.5. The vulnerability was disclosed on June 20, 2025, and involves broken access control security levels (NVD, Patchstack).

The vulnerability is classified as a Missing Authorization (CWE-862) issue that allows exploiting incorrectly configured access control security levels. The CVSS v3.1 base score is 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, indicating network accessibility with low attack complexity and requiring low privileges (NVD, Wiz).

The vulnerability can lead to unauthorized access and potential exploitation of access control mechanisms. The CVSS scoring indicates potential impacts on integrity and availability, though confidentiality is not affected (Patchstack).

As of the disclosure date, version 4.5.6 has been released to address this vulnerability. Users are advised to update to version 4.5.6 or later to remove the vulnerability. The security issue has been assessed as having a low severity impact and is considered unlikely to be exploited (Patchstack).