CVE-2025-62006

MediumCVSS 5.4

Published: 22/10/2025(UTC)Updated: 08/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.28%

19th percentile - higher than 19% of all known CVEs

Summary

The WP SMS plugin (versions up to and including 7.0.1) contains a Missing Authorization vulnerability. It allows exploitation of incorrectly configured access control security levels.

Risk Assessment

An unauthorized user may gain access to functions or data they should not have permission to. This could lead to disclosure or modification of information.

Recommendation

Update the WP SMS plugin to the latest version that fixes the vulnerability. If updating is not possible, consider disabling the plugin.

Other vulnerabilities in WP SMS

CVE-2026-40790Medium
There is a vulnerability in WP SMS versions up to 7.2.1 that exposes sensitive subscriber data.

Original NVD description (English source)

Missing Authorization vulnerability in VeronaLabs WP SMS wp-sms.This issue affects WP SMS: from n/a through <= 7.0.1.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS