CVE-2025-62754: 
WordPress vulnerability analysis and mitigation

CVE-2025-62754 is a Missing Authorization (Broken Access Control) vulnerability in the "Payment Gateway bKash for WC" WordPress plugin, developed by Kapil Paul. It affects all versions up to and including 3.1.0, allowing unauthenticated network attackers to exploit incorrectly configured access control security levels. The vulnerability was reported by researcher Legion Hunter on October 21, 2025, and published by Patchstack on November 20, 2025, with CVE assignment on January 22, 2026. The CNA (Patchstack) assigned a CVSS v3.1 score of 5.3 (Medium), while CISA-ADP initially scored it 9.1 (Critical) before the Patchstack score was updated; the current authoritative score from Patchstack is 5.3 (Medium) (Patchstack, NVD).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the plugin fails to perform adequate authorization checks before executing sensitive payment gateway functions. An unauthenticated remote attacker can send crafted network requests to plugin endpoints that lack proper nonce token, authentication, or capability checks, thereby invoking privileged actions without credentials. This falls under OWASP Top 10 category A1: Broken Access Control. No detailed technical write-up or public proof-of-concept code has been published as of the available data (Patchstack, NVD).

Exploitation could allow an unauthenticated attacker to perform unauthorized operations against the bKash payment gateway integration, potentially including unauthorized transactions, manipulation of payment data, or access to sensitive payment-related information stored or processed by the plugin. The integrity and confidentiality of payment data are at risk, though availability is not directly impacted. The scope is limited to WordPress sites running WooCommerce with this plugin installed and active (Patchstack).

No public proof-of-concept exploit code has been published, and there is no evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress sites at scale, regardless of site popularity (Patchstack).

As of the available data, no official patched version of the Payment Gateway bKash for WC plugin has been released; the plugin remains vulnerable through version 3.1.0. Site administrators should consider temporarily disabling the bKash payment gateway plugin until a patched version is available. As interim mitigations, implement network-level access controls to restrict access to plugin endpoints, monitor for suspicious or unauthorized API calls related to the payment gateway, and consult your hosting provider for additional hardening options. Monitor the plugin's WordPress repository and Patchstack for patch availability (Patchstack).

The vulnerability was discovered and disclosed by researcher Legion Hunter through Patchstack's coordinated disclosure process. Patchstack classifies this as low priority with low immediate impact, noting no active exploitation has been observed. No significant broader media coverage or notable community commentary has been identified beyond the Patchstack advisory (Patchstack).