CVE-2025-53236
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
The UDesign Core plugin by AndonDesign is vulnerable to Missing Authorization in versions from n/a through 4.14.0. This issue allows exploiting incorrectly configured access control security levels.
Risk Assessment
The risk involves unauthorized access to plugin features, potentially leading to security breaches or unauthorized modifications.
Recommendation
Update UDesign Core to a patched version and review permission settings.
Other vulnerabilities in UDesign Core
See all- CVE-2026-42416High
The UDesign Core plugin in versions up to and including 4.15.0 contains a Subscriber-level SQL Injection vulnerability. The flaw allows injection of malicious SQL queries into the database.
- CVE-2025-62051Medium
The UDesign Core plugin by AndonDesign contains a Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This issue affects UDesign Core from n/a through <= 4.14.1.
Original NVD description (English source)
Missing Authorization vulnerability in AndonDesign UDesign Core u-design-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UDesign Core: from n/a through <= 4.14.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS