CVE-2025-62092: 
WordPress vulnerability analysis and mitigation

CVE-2025-62092 is a Missing Authorization (Broken Access Control) vulnerability in the Wiremo WooCommerce Reviews WordPress plugin (woo-reviews-by-wiremo). It allows unauthenticated network attackers to exploit incorrectly configured access control security levels, resulting in unauthorized data modification. The vulnerability affects all plugin versions through 1.5.6 (initially reported as through 1.4.99, later revised). It was reported by researcher Legion Hunter on October 21, 2025, and publicly disclosed by Patchstack on December 31, 2025. The CVSS v3.1 base score is 5.3 (Medium), assigned by Patchstack (Patchstack).

The root cause is classified as CWE-862 (Missing Authorization), corresponding to OWASP Top 10 category A1: Broken Access Control. The plugin fails to perform adequate authorization, authentication, or nonce token checks on one or more functions, allowing unauthenticated users to invoke actions that should be restricted to privileged roles. The attack vector is network-based, requires no privileges or user interaction, and has low attack complexity — meaning any remote, unauthenticated attacker can trigger the vulnerable functionality with minimal effort (Patchstack).

Successful exploitation results in a limited integrity impact — unauthenticated attackers can perform unauthorized actions (such as modifying review data or plugin settings) that should require elevated privileges. There is no confidentiality or availability impact based on the CVSS assessment. While the individual impact is low, Patchstack notes that vulnerabilities of this class are commonly used in mass-exploit campaigns targeting thousands of WordPress sites simultaneously, regardless of site size or traffic (Patchstack).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.028% (0.000280), indicating a very low probability of exploitation in the near term. Patchstack classifies this as low priority with no impactful threat, and it is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Patchstack).

As of the time of disclosure, no official patch from the Wiremo plugin developer is available — Patchstack lists the patched version as "No official patch available" for versions through 1.5.6. Site administrators should monitor the WordPress plugin repository for an updated version and apply it immediately upon release. In the interim, disabling or removing the woo-reviews-by-wiremo plugin is the most effective workaround. Patchstack customers received early warning and virtual patching protection as of December 31, 2025 (Patchstack).