CVE-2025-62870: 
WordPress vulnerability analysis and mitigation

CVE-2025-62870 is a Missing Authorization (Broken Access Control) vulnerability in the Eupago Gateway For WooCommerce WordPress plugin, affecting all versions up to and including 4.7.1. The vulnerability was reported by researcher 0xd4rk5id3 on November 8, 2025, and published by Patchstack on December 8, 2025. It carries a CVSS v3.1 base score of 5.3 (Medium), exploitable by unauthenticated remote attackers (Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning one or more plugin functions fail to perform adequate authorization, authentication, or nonce token checks before executing privileged actions. This allows unauthenticated users to invoke functionality that should be restricted to higher-privileged roles. The attack vector is network-based, requires no user interaction, and has low attack complexity, making it straightforward to exploit remotely (Patchstack). No public proof-of-concept code has been identified at this time.

Successful exploitation allows an unauthenticated attacker to perform unauthorized actions within the WooCommerce payment gateway plugin, resulting in a low integrity impact with no confidentiality or availability impact per the CVSS assessment. In practice, this could allow attackers to manipulate payment gateway settings or trigger privileged plugin functions without proper credentials. The scope is limited to the affected WordPress installation, but mass-exploit campaigns targeting WordPress plugins at scale are a known risk for this class of vulnerability (Patchstack).

No active in-the-wild exploitation has been reported, and Patchstack rates the priority as Low, noting the issue is unlikely to be exploited in a targeted manner. The EPSS score is approximately 0.017%, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No exploit kits or threat actor attribution have been identified (Patchstack).

As of the disclosure date, no official patched version of the Eupago Gateway For WooCommerce plugin has been released; the vulnerable version range is all versions through 4.7.1. Site administrators should monitor the WordPress plugin repository for an updated release and apply it immediately upon availability. In the interim, disabling the plugin or restricting access to the WordPress admin panel via IP allowlisting can reduce exposure. Patchstack users with virtual patching enabled receive automatic protection (Patchstack).

The vulnerability was discovered and disclosed by independent researcher 0xd4rk5id3 through Patchstack's vulnerability disclosure program. Patchstack classified it as low priority with no impactful threat, and no significant broader media coverage or notable community discussion has been identified (Patchstack).