CVE-2025-62090

MediumCVSS 6.5

Published: 09/12/2025(UTC)Updated: 07/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

15th percentile - higher than 15% of all known CVEs

Summary

Gutenverse News plugin (versions up to 3.0.2) has a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. An unauthorized user can perform actions they are not permitted to.

Risk Assessment

An attacker could bypass access control mechanisms and perform unauthorized operations, potentially leading to data modification or information disclosure on the WordPress site.

Recommendation

Update the Gutenverse News plugin to the latest version (above 3.0.2) or review and correct user role permissions.

Other vulnerabilities in Gutenverse News

CVE-2026-85677High
The Gutenverse News WordPress plugin before 3.3.3 does not restrict the extra HTML it adds to WordPress's allowed elements to the context it is meant for, applying the same relaxed list to every sanitisation context including untrusted comments, allowing unauthenticated users to store JavaScript that will execute in the browser of any administrator who reviews the comment queue, and of any visitor to the post once the comment is approved.

Original NVD description (English source)

Missing Authorization vulnerability in Jegstudio Gutenverse News – Advanced News Magazine Blog Gutenberg Blocks Addons gutenverse-news allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gutenverse News – Advanced News Magazine Blog Gutenberg Blocks Addons: from n/a through <= 3.0.2.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS