CVE-2025-62078

MediumCVSS 4.3

Published: 31/12/2025(UTC)Updated: 28/09/2026(UTC)Translated: 23/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.22%

11th percentile - higher than 11% of all known CVEs

Summary

The Easy Upload Files During Checkout plugin up to version 3.0.0 contains a missing authorization vulnerability. It allows exploiting incorrectly configured access control security levels.

Risk Assessment

Unauthorized users may perform operations without proper permissions, potentially leading to data integrity issues or unauthorized file uploads.

Recommendation

Update the Easy Upload Files During Checkout plugin to the latest version that includes a security fix.

Other vulnerabilities in Easy Upload Files During Checkout

CVE-2026-6802Medium
The Easy Upload Files During Checkout plugin for WordPress versions up to 3.0.1 is vulnerable to unauthorized access. The ufdc_custom_init() function processes the 'eufdc-delete' parameter without nonce verification, capability check, or attachment ownership validation, allowing unauthenticated attackers to permanently delete arbitrary media library attachments.

Original NVD description (English source)

Missing Authorization vulnerability in Fahad Mahmood Easy Upload Files During Checkout easy-upload-files-during-checkout allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Upload Files During Checkout: from n/a through <= 3.0.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS