Cyber Posture

CVE-2025-69381

High

Published: 20 February 2026

Published
20 February 2026
Modified
15 April 2026
KEV Added
Patch
CVSS Score 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
EPSS Score 0.0006 17.0th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-69381 is a high-severity Missing Authorization (CWE-862) vulnerability. Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 17.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Privilege Escalation (T1068) and 1 other technique.
Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-862

Requiring an access control policy ensures authorization checks are defined and applied for critical functions.

addresses: CWE-862

Reviews of access controls detect missing authorization checks on critical functions or resources.

addresses: CWE-862

Documenting permitted unauthenticated actions prevents missing authorization by making all exceptions explicit and subject to organizational review.

addresses: CWE-862

Requiring attribute association with information prevents authorization from being performed without necessary security or privacy context.

addresses: CWE-862

Mandating authorization prior to allowing remote connections addresses missing authorization for remote access.

addresses: CWE-862

Mandating authorization before wireless connections are allowed prevents missing authorization for wireless access.

addresses: CWE-862

The control requires authorization before allowing mobile device connections, directly mitigating missing authorization for system access.

addresses: CWE-862

Requiring approvals for account creation and specifying authorizations ensures authorization is not missing for system access.

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Missing authorization (CWE-862) in public-facing WordPress plugin directly enables remote exploitation by low-privileged users for unauthorized modifications and availability impact, mapping to privilege escalation via exploitation and public-facing app exploitation.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

NVD Description

Missing Authorization vulnerability in vanquish WooCommerce Bulk Product Editor woocommerce-quick-product-editor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Bulk Product Editor: from n/a through <= 3.0.

Deeper analysisAI

CVE-2025-69381 is a missing authorization vulnerability (CWE-862) in the WooCommerce Bulk Product Editor WordPress plugin, also known as woocommerce-quick-product-editor. The flaw enables exploitation of incorrectly configured access control security levels and affects all versions from n/a through 3.0. Published on 2026-02-20, it carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H).

Low-privileged authenticated users (PR:L) can exploit this vulnerability remotely over the network (AV:N) with low attack complexity (AC:L) and without requiring user interaction (UI:N). Successful exploitation results in low integrity impact (I:L), such as unauthorized modifications, and high availability impact (A:H), potentially disrupting service, while confidentiality remains unaffected (C:N) with unchanged scope (S:U).

The Patchstack advisory provides details on the vulnerability, including potential patches and mitigation steps, available at https://patchstack.com/database/Wordpress/Plugin/woocommerce-quick-product-editor/vulnerability/wordpress-woocommerce-bulk-product-editor-plugin-3-0-broken-access-control-vulnerability?_s_id=cve.

Details

CWE(s)

CVEs Like This One

CVE-2026-22683Shared CWE-862
CVE-2026-41454Shared CWE-862
CVE-2025-67967Shared CWE-862
CVE-2025-12158Shared CWE-862
CVE-2024-13232Shared CWE-862
CVE-2026-28515Shared CWE-862
CVE-2026-0511Shared CWE-862
CVE-2026-32501Shared CWE-862
CVE-2026-0506Shared CWE-862
CVE-2026-0974Shared CWE-862

References