CVE-2025-62151: 
WordPress vulnerability analysis and mitigation

CVE-2025-62151 is a Missing Authorization vulnerability in the Virtuaria PagBank / PagSeguro para WooCommerce WordPress plugin that allows authenticated low-privilege attackers to exploit incorrectly configured access control security levels. It affects all versions of the plugin from n/a through 3.6.3. The vulnerability was published on December 9, 2025, and was assigned by Patchstack. It carries a CVSS v3.1 base score of 8.8 (High) (Feedly, EUVD).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether an authenticated user has the appropriate permissions before granting access to sensitive functionality or resources. An attacker with a low-privilege WordPress account (e.g., subscriber or customer role) can send crafted requests to plugin endpoints that lack proper authorization checks, thereby bypassing intended access controls. No complex preconditions are required beyond having a valid low-privilege account on the target WordPress site. No public technical write-up or proof-of-concept code has been identified at this time (Feedly, Patchstack).

Successful exploitation allows authenticated low-privilege attackers to gain unauthorized access to sensitive resources within the WooCommerce environment, potentially compromising the confidentiality of payment-related and customer data, modifying or deleting records, and performing unauthorized administrative actions. Given the plugin's role in processing PagBank/PagSeguro payment transactions, exposure of payment configuration data or order records is a significant concern. The scope is limited to the affected WordPress installation, but lateral movement within the site's data and functionality is possible (Feedly).

Users should upgrade the Virtuaria PagBank / PagSeguro para WooCommerce plugin to a version newer than 3.6.3 as soon as a patched release becomes available. In the interim, site administrators should audit current access controls within the WooCommerce environment, temporarily restrict plugin access to trusted roles only, and apply the principle of least privilege for all plugin users. Monitoring WordPress and server logs for unexpected access to plugin endpoints by low-privilege accounts is also recommended (Feedly, Patchstack).