CVE-2025-62995: 
WordPress vulnerability analysis and mitigation

CVE-2025-62995 is a Missing Authorization (Broken Access Control) vulnerability in the MultiParcels Shipping For WooCommerce WordPress plugin. It affects all versions up to and including 1.30.12, and was discovered by researcher Legion Hunter and reported on November 5, 2025, with public disclosure on December 5–9, 2025. The vulnerability allows low-privileged authenticated users (Subscriber level) to perform actions beyond their intended authorization. It carries a CVSS v3.1 base score of 4.3 (Medium) (Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether an authenticated user has the appropriate permissions before executing certain privileged actions. An attacker with at minimum Subscriber-level access can send crafted network requests to trigger functionality that should be restricted to higher-privileged roles. The attack vector is network-based, requires low privileges, low complexity, and no user interaction. No specific technical write-up or public PoC code has been identified beyond the Patchstack advisory (Patchstack).

Successful exploitation results in a limited integrity impact — an authenticated low-privileged user can perform unauthorized actions within the WooCommerce shipping management context. There is no confidentiality or availability impact per the CVSS scoring. While the individual impact is low, Patchstack notes that vulnerabilities of this class are frequently used in mass-exploit campaigns targeting thousands of WordPress sites simultaneously, regardless of site size or popularity (Patchstack).

No public proof-of-concept exploit code or confirmed in-the-wild exploitation has been reported for CVE-2025-62995. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack classifies this as low priority with unlikely exploitation impact (Patchstack).

The vendor has released version 1.30.13 of the MultiParcels Shipping For WooCommerce plugin, which patches this vulnerability. Site administrators should update to version 1.30.13 or later immediately via the WordPress plugin dashboard. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard. If an immediate update is not possible, site owners should contact their hosting provider or web developer for assistance (Patchstack).