CVE-2025-30772
Published: 27 March 2025
Summary
CVE-2025-30772 is a high-severity Missing Authorization (CWE-862) vulnerability. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 40.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-30772 is a missing authorization vulnerability (CWE-862) in the WPClever WPC Smart Upsell Funnel for WooCommerce plugin, which enables privilege escalation. The issue affects all versions of the plugin up to and including 3.0.4. It has a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its network accessibility, low attack complexity, and significant impacts on confidentiality, integrity, and availability.
A low-privileged authenticated user, such as a subscriber, can exploit this vulnerability over the network without user interaction. Successful exploitation allows arbitrary option updates, leading to privilege escalation, potentially granting the attacker administrative control over the WordPress site.
The Patchstack advisory details the vulnerability as an arbitrary option update issue and recommends updating to a patched version beyond 3.0.4 to mitigate the risk.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-8401
Vulnerability details
Missing Authorization vulnerability in WPClever WPC Smart Upsell Funnel for WooCommerce wpc-smart-upsell-funnel allows Privilege Escalation.This issue affects WPC Smart Upsell Funnel for WooCommerce: from n/a through <= 3.0.4.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a missing authorization flaw allowing low-privileged authenticated users to perform arbitrary option updates, directly resulting in privilege escalation to administrative control on the WordPress site.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces approved authorizations for access to system resources such as option updates, directly addressing the missing authorization vulnerability exploited for privilege escalation.
Requires identification, reporting, and correction of the specific flaw in the WPC Smart Upsell Funnel plugin via patching to version >3.0.4.
Implements least privilege to limit low-privileged users like subscribers from performing administrative option updates even if authorization is bypassed.