CVE-2025-62881: 
WordPress vulnerability analysis and mitigation

CVE-2025-62881 is a Missing Authorization (Broken Access Control) vulnerability in the WP Lab WP-Lister Lite for eBay WordPress plugin. It affects all versions up to and including 3.8.3, and was reported by researcher Nguyen Tran Tuan Dung (domiee13) on April 27, 2025, with public disclosure on May 27, 2025. The vulnerability carries a CVSS v3.1 base score of 4.3 (Medium), requiring low privileges and no user interaction to exploit (Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning one or more plugin functions lack proper authorization, authentication, or nonce token checks. This allows a low-privileged user (at the Subscriber level or above) to invoke actions that should be restricted to higher-privileged roles such as administrators. The attack vector is network-based with low complexity, requiring only a valid low-privilege account on the WordPress site (Patchstack, RedHat CVE).

Successful exploitation allows an authenticated low-privileged user (e.g., a Subscriber) to perform unauthorized actions within the WP-Lister Lite for eBay plugin that should be restricted to administrators. The integrity impact is low, with no confidentiality or availability impact assessed. While the individual impact is limited, Patchstack notes that vulnerabilities of this class are commonly used in mass-exploit campaigns targeting thousands of WordPress sites simultaneously (Patchstack).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.017%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack classifies this as low priority with no impactful threat currently observed (Patchstack, RedHat CVE).

WP Lab has released version 3.8.5 of WP-Lister Lite for eBay, which patches this vulnerability. Site administrators should update the plugin to version 3.8.5 or later immediately. If an immediate update is not possible, restricting site registration to trusted users or disabling the plugin temporarily can reduce exposure. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard (Patchstack).