Skip to content
OpenAdvisories

Weakness (CWE)

CWE-862: Missing Authorization

Class Incomplete

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

How to prevent it (5 mitigations)

  1. Architecture and Design

    Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.

    Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.

  2. Architecture and Design

    Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

  3. Architecture and Design

    Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.

    For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].

  4. Architecture and Design

    For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.

    One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.

  5. System Configuration, Installation

    Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.

Source: MITRE CWE-862

All Critical High Medium Low Exploited only Public exploit

7,357 results · Clear filters · Feed

  • Medium 4.7
    CVE-2025-67586 Public exploit

    WordPress Highlight and Share plugin <= 5.2.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Ronald Huereca Highlight and Share highlight-and-share allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Highlight and Share: from n/a through <= 5.2.0.

    Ronald Huereca Highlight and Share
  • Medium 4.3
    CVE-2025-67588

    WordPress Elementor Website Builder plugin <= 3.33.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Elementor Elementor Website Builder elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Elementor Website Builder: from n/a through <= 3.33.0.

    Elementor Elementor Website Builder
  • Medium 5.3
    CVE-2025-67581

    WordPress TrueBooker plugin <= 1.1.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in themetechmount TrueBooker truebooker-appointment-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TrueBooker: from n/a through <= 1.1.0.

    themetechmount TrueBooker
  • Medium 5.3
    CVE-2025-67584

    WordPress GoDAM plugin <= 1.4.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in rtCamp GoDAM godam allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GoDAM: from n/a through <= 1.4.6.

    rtcamp GoDAM
  • Medium 5.3
    CVE-2025-67583

    WordPress IDonate plugin <= 2.1.15 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Foysal Imran IDonate idonate allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects IDonate: from n/a through <= 2.1.15.

    Foysal Imran IDonate
  • Medium 5.3
    CVE-2025-67580

    WordPress Constant Contact + WooCommerce plugin <= 2.4.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Constant Contact Constant Contact + WooCommerce constant-contact-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Constant Contact + WooCommerce: from n/a through <= …

    Constant Contact Constant Contact + WooCommerce Web / CMS
  • Medium 5.3
    CVE-2025-67582

    WordPress Wbcom Designs plugin <= 2.1.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in wbcomdesigns Wbcom Designs lock-my-bp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wbcom Designs: from n/a through <= 2.1.1.

    Wbcom Designs Wbcom Designs
  • Medium 5.3
    CVE-2025-67578

    WordPress WP Email Capture plugin <= 3.12.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Rhys Wynne WP Email Capture wp-email-capture allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Email Capture: from n/a through <= 3.12.4.

    Rhys Wynne WP Email Capture
  • Medium 5.3
    CVE-2025-67577

    WordPress Easy Form Builder plugin <= 3.8.20 - Broken Access Control vulnerability

    Missing Authorization vulnerability in hassantafreshi Easy Form Builder easy-form-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Form Builder: from n/a through <= 3.8.20.

    hassantafreshi Easy Form Builder
  • Medium 5.3
    CVE-2025-67579

    WordPress User Extra Fields plugin <= 16.8 - Broken Access Control vulnerability

    Missing Authorization vulnerability in vanquish User Extra Fields wp-user-extra-fields allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Extra Fields: from n/a through <= 16.8.

    vanquish User Extra Fields
  • Medium 5.3
    CVE-2025-67576

    WordPress Simple Link Directory plugin <= 8.8.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in QuantumCloud Simple Link Directory simple-link-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Link Directory: from n/a through <= 8.8.3.

    Quantum Cloud Simple Link Directory
  • Medium 5.3
    CVE-2025-67573

    WordPress Sailing theme < 4.4.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in ThimPress Sailing sailing allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sailing: from n/a through < 4.4.6.

    ThimPress Sailing
  • Medium 5.3
    CVE-2025-67572

    WordPress PenNews theme < 6.7.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in PenciDesign PenNews pennews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PenNews: from n/a through < 6.7.4.

    PenciDesign PenNews
  • Medium 5.3
    CVE-2025-67575

    WordPress Sitewide Notice WP plugin <= 2.4.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Andrew Lima Sitewide Notice WP sitewide-notice-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sitewide Notice WP: from n/a through <= 2.4.1.

    Andrew Lima Sitewide Notice WP
  • Medium 5.3
    CVE-2025-67574

    WordPress Booking calendar, Appointment Booking System plugin <= 3.2.30 - Broken Access Control vulnerability

    Missing Authorization vulnerability in wpdevart Booking calendar, Appointment Booking System booking-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking calendar, Appointment Booking System: from n/a thr…

    wpdevart Booking calendar, Appointment Booking System
  • Medium 5.3
    CVE-2025-67568

    WordPress Basel theme <= 5.9.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in xtemos Basel basel allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Basel: from n/a through <= 5.9.1.

    Xtemos Basel
  • Medium 5.3
    CVE-2025-67571

    WordPress WPFunnels plugin <= 3.6.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WPFunnels WPFunnels wpfunnels allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPFunnels: from n/a through <= 3.6.2.

    WPFunnels WPFunnels
  • Medium 5.3
    CVE-2025-67569

    WordPress AdForest theme <= 6.0.11 - Broken Access Control vulnerability

    Missing Authorization vulnerability in scriptsbundle AdForest adforest allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AdForest: from n/a through <= 6.0.11.

    scriptsbundle AdForest
  • Medium 5.3
    CVE-2025-67570

    WordPress WPForms Google Sheet Connector plugin <= 4.0.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WesternDeal WPForms Google Sheet Connector gsheetconnector-wpforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPForms Google Sheet Connector: from n/a through <= 4.0.0.

    westerndeal WPForms Google Sheet Connector
  • Medium 5.3
    CVE-2025-67563

    WordPress Post SMTP plugin <= 3.6.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Saad Iqbal Post SMTP post-smtp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post SMTP: from n/a through <= 3.6.1.

    Saad Iqbal Post SMTP
  • Medium 5.3
    CVE-2025-67566

    WordPress Woffice Core plugin <= 5.4.30 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WofficeIO Woffice Core woffice-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Woffice Core: from n/a through <= 5.4.30.

    WofficeIO Woffice Core
  • Medium 5.4
    CVE-2025-67561

    WordPress Debug Log Viewer plugin <= 2.0.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Oleksandr Lysyi Debug Log Viewer debug-log-viewer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Debug Log Viewer: from n/a through <= 2.0.3.

    Oleksandr Lysyi Debug Log Viewer
  • Medium 5.4
    CVE-2025-67562

    WordPress Image Caption Hover Pro plugin < 20.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WebCodingPlace Image Caption Hover Pro image-caption-hover-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Image Caption Hover Pro: from n/a through < 20.0.

    WebCodingPlace Image Caption Hover Pro
  • Medium 5.4
    CVE-2025-67560

    WordPress Listdom plugin <= 5.0.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Webilia Inc. Listdom listdom allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Listdom: from n/a through <= 5.0.1.

    Webilia Listdom
  • Medium 5.4
    CVE-2025-67559

    WordPress Online Booking & Scheduling Calendar for WordPress by vcita plugin <= 4.5.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita meeting-scheduler-by-vcita allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Online Booking & Scheduling Calendar…

    vcita Online Booking & Scheduling Calendar for WordPress by vcita Web / CMS
  • Medium 6.5
    CVE-2025-67548

    WordPress WP Delicious plugin <= 1.9.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WP Delicious WP Delicious delicious-recipes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Delicious: from n/a through <= 1.9.1.

    WP Delicious WP Delicious
  • Medium 6.5
    CVE-2025-67540

    WordPress Animation Addons for Elementor plugin <= 2.4.5 - Arbitrary Content Deletion vulnerability

    Missing Authorization vulnerability in Wealcoder Animation Addons for Elementor animation-addons-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Animation Addons for Elementor: from n/a through <= 2.4.5.

    wealcoder Animation Addons for Elementor
  • Medium 4.3
    CVE-2025-67474

    WordPress ForumWP plugin <= 2.1.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Ultimate Member ForumWP forumwp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ForumWP: from n/a through <= 2.1.4.

    Ultimate Member ForumWP
  • Medium 4.3
    CVE-2025-67468

    WordPress Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms plugin <= 1.4.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in CRM Perks Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms cf7-salesforce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Integration f…

    CRM Perks Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms
  • Medium 4.3
    CVE-2025-67466

    WordPress Trinity Audio plugin <= 5.23.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in sergiotrinity Trinity Audio trinity-audio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Trinity Audio: from n/a through <= 5.23.3.

    sergiotrinity Trinity Audio
  • Medium 4.3
    CVE-2025-66534

    WordPress The Aisle theme <= 2.9 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Elated-Themes The Aisle theaisle allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Aisle: from n/a through <= 2.9.

    Elated-Themes The Aisle
  • Medium 4.3
    CVE-2025-66532

    WordPress Powerlift theme < 3.2.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Mikado-Themes Powerlift powerlift allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Powerlift: from n/a through < 3.2.1.

    Mikado-Themes Powerlift
  • Medium 4.3
    CVE-2025-66527

    WordPress Lobo theme <= 2.8.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in VanKarWai Lobo lobo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Lobo: from n/a through <= 2.8.6.

    VanKarWai Lobo
  • Medium 4.3
    CVE-2025-66526

    WordPress Tablesome plugin <= 1.1.34 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Essekia Tablesome tablesome allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tablesome: from n/a through <= 1.1.34.

    Essekia Tablesome
  • Medium 4.3
    CVE-2025-66528

    WordPress Thank You Page Customizer for WooCommerce plugin <= 1.1.8 - Broken Access Control vulnerability

    Missing Authorization vulnerability in VillaTheme Thank You Page Customizer for WooCommerce woo-thank-you-page-customizer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Thank You Page Customizer for WooCommerce: fro…

    villatheme Thank You Page Customizer for WooCommerce Web / CMS
  • Medium 4.3
    CVE-2025-66530

    WordPress Webba Booking plugin <= 6.2.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Webba Appointment Booking Webba Booking webba-booking-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Webba Booking: from n/a through <= 6.2.1.

    Webba Appointment Booking Webba Booking
  • Medium 4.3
    CVE-2025-66525

    WordPress Elastic Email Sender plugin <= 1.2.20 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Elastic Email Elastic Email Sender elastic-email-sender allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Elastic Email Sender: from n/a through <= 1.2.20.

    Elastic Email Elastic Email Sender
  • Medium 4.3
    CVE-2025-64257

    WordPress My Tickets plugin <= 2.1.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Joe Dolson My Tickets my-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects My Tickets: from n/a through <= 2.1.0.

    Joe Dolson My Tickets
  • Medium 5.5
    CVE-2025-42891

    Missing Authorization check in SAP Enterprise Search for ABAP

    Due to a missing authorization check in SAP Enterprise Search for ABAP, an attacker with high privileges may read and export the contents of database tables into an ABAP report. This could lead to a high impact on data confidentiality and a low impact on data…

    SAP SAP Enterprise Search for ABAP
  • Medium 4.3
    CVE-2025-48614

    In rebootWipeUserData of RecoverySystem.java, there is a possible way to factory reset the device while in DSU mode due…

    Google Android Android