CVE-2025-64285: 
WordPress vulnerability analysis and mitigation

CVE-2025-64285 is a Missing Authorization (Broken Access Control) vulnerability in the Premmerce Wholesale Pricing for WooCommerce WordPress plugin. It affects all versions up to and including 1.1.10, allowing authenticated low-privileged users to exploit incorrectly configured access control security levels. The vulnerability was reported by researcher Nguyen Xuan Chien on February 16, 2025, published by Patchstack on April 22, 2025, and assigned a CVE on October 29, 2025. It carries a CVSS v3.1 base score of 5.4 (Medium) (Patchstack).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether an authenticated user has the appropriate permissions before executing certain privileged actions. This falls under OWASP Top 10 A1: Broken Access Control. Exploitation requires a network-accessible WordPress installation and a low-privileged authenticated account (e.g., Contributor role), with no user interaction required and low attack complexity. No public proof-of-concept code has been identified at this time (Patchstack).

Successful exploitation allows a low-privileged authenticated attacker to perform actions beyond their intended authorization level, resulting in limited integrity and availability impacts (no confidentiality impact per the CVSS assessment). An attacker could manipulate wholesale pricing configurations or disrupt pricing-related functionality within the WooCommerce store. The scope is limited to the affected plugin's functionality and does not directly enable remote code execution or full site takeover (Patchstack).

No public exploit code or active in-the-wild exploitation has been reported for this vulnerability. Patchstack rates this as low priority with "no impactful threat" and notes it is unlikely to be exploited. The EPSS score is approximately 0.017%, indicating a very low probability of exploitation in the near term. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Patchstack, Feedly).

The vulnerability is patched in version 1.1.11 of the Premmerce Wholesale Pricing for WooCommerce plugin. Site administrators should update to version 1.1.11 or later immediately. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard. If an immediate update is not possible, restricting Contributor-level user registrations or limiting access to the WordPress admin area can reduce exposure (Patchstack).