CVE-2025-62953: 
WordPress vulnerability analysis and mitigation

A Missing Authorization vulnerability (CVE-2025-62953) was discovered in the nanbu Welcart e-Commerce usc-e-shop WordPress plugin, affecting versions through 2.11.24. The vulnerability was initially reported on October 14, 2025, and was last updated on October 28, 2025 (NVD, Wordfence).

The vulnerability is classified as CWE-862 (Missing Authorization) and received a CVSS v3.1 Base Score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. This indicates that the vulnerability can be exploited over the network, requires low attack complexity, needs low privileges, and no user interaction, potentially resulting in high impacts to confidentiality, integrity, and availability (NVD).

The vulnerability allows attackers to exploit incorrectly configured access control security levels, potentially leading to unauthorized access and control over affected systems. The high CVSS score indicates severe potential impacts on system confidentiality, integrity, and availability (NVD).

Users are advised to update their Welcart e-Commerce plugin to a version newer than 2.11.24 once available. No specific workarounds have been publicly disclosed at this time (NVD).