Cyber Resilience

CVE-2025-69381

High

Published: 20 February 2026

Published
20 February 2026
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
EPSS Score 0.0006 17.4th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-69381 is a high-severity Missing Authorization (CWE-862) vulnerability. Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 17.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).

Deeper analysis

CVE-2025-69381 is a missing authorization vulnerability (CWE-862) in the WooCommerce Bulk Product Editor WordPress plugin, also known as woocommerce-quick-product-editor. The flaw enables exploitation of incorrectly configured access control security levels and affects all versions from n/a through 3.0. Published on 2026-02-20, it carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H).

Low-privileged authenticated users (PR:L) can exploit this vulnerability remotely over the network (AV:N) with low attack complexity (AC:L) and without requiring user interaction (UI:N). Successful exploitation results in low integrity impact (I:L), such as unauthorized modifications, and high availability impact (A:H), potentially disrupting service, while confidentiality remains unaffected (C:N) with unchanged scope (S:U).

The Patchstack advisory provides details on the vulnerability, including potential patches and mitigation steps, available at https://patchstack.com/database/Wordpress/Plugin/woocommerce-quick-product-editor/vulnerability/wordpress-woocommerce-bulk-product-editor-plugin-3-0-broken-access-control-vulnerability?_s_id=cve.

EU & UK References

Vulnerability details

Missing Authorization vulnerability in vanquish WooCommerce Bulk Product Editor woocommerce-quick-product-editor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Bulk Product Editor: from n/a through <= 3.0.

CWE(s)
CWE-862

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Missing authorization (CWE-862) in public-facing WordPress plugin directly enables remote exploitation by low-privileged users for unauthorized modifications and availability impact, mapping to privilege escalation via exploitation and public-facing app exploitation.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2026-4100Shared CWE-862
CVE-2026-32501Shared CWE-862
CVE-2025-31194Shared CWE-862
CVE-2026-6963Shared CWE-862
CVE-2024-9195Shared CWE-862
CVE-2025-6380Shared CWE-862
CVE-2026-0506Shared CWE-862
CVE-2025-2110Shared CWE-862
CVE-2025-27270Shared CWE-862
CVE-2026-6510Shared CWE-862

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

AC-3 Access Enforcement good match
prevent

Directly enforces authorization checks before allowing bulk product edits, blocking the missing-authorization flaw that lets low-privileged users modify or disrupt products.

AC-6 Least Privilege partial match
prevent

Limits the capabilities granted to authenticated users so that even if authorization is missing they cannot reach high-availability-impact actions such as bulk product changes.

CM-5 Access Restrictions for Change partial match
prevent

Restricts which roles may perform configuration or content changes, directly mitigating unauthorized product-editor operations described in the CVE.

References