CVE-2025-62869: 
WordPress vulnerability analysis and mitigation

CVE-2025-62869 is a Missing Authorization (Broken Access Control) vulnerability in the Gravitec.net – Web Push Notifications WordPress plugin. It affects all versions up to and including 2.9.17, and was reported by researcher Nabil Irawan on November 6, 2025, with public disclosure on December 6–9, 2025. The vulnerability carries a CVSS v3.1 base score of 4.3 (Medium), requiring low privileges (Subscriber level) to exploit (Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the plugin fails to perform adequate authorization, authentication, or nonce token checks on one or more functions. This allows a low-privileged authenticated user (e.g., a Subscriber-level account) to invoke functionality that should be restricted to higher-privileged roles, exploiting incorrectly configured access control security levels. No public proof-of-concept code has been identified at this time (Patchstack).

Successful exploitation allows an authenticated low-privileged attacker to perform unauthorized actions that should be restricted to higher-privileged users, resulting in a limited integrity impact. Confidentiality and availability are not directly affected, as the CVSS score reflects no confidentiality or availability impact. The practical consequence is unauthorized modification of plugin settings or data, which could affect push notification behavior on the WordPress site (Patchstack).

The vulnerability requires low-level authentication (Subscriber role) and has low attack complexity with no user interaction needed, making it accessible to any registered user on the affected WordPress site. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of active exploitation in the near term. No in-the-wild exploitation, threat actor attribution, or CISA KEV catalog listing has been identified. Patchstack classifies this as low priority with no impactful threat (Patchstack).

The vulnerability is patched in version 2.9.18 of the Gravitec.net – Web Push Notifications plugin. Site administrators should update to version 2.9.18 or later immediately via the WordPress plugin dashboard. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard. If an immediate update is not possible, restricting user registration or limiting Subscriber-level accounts on the site can reduce exposure (Patchstack).