WordPress Plugin Vulnerabilities

WowRevenue < 1.2.14 - Missing Authorization

Description

The Product Bundles, Quantity/Bulk Discount, BOGO, Buy X Get Y – WowRevenue plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.2.13. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized action.

Affects Plugins

Plugin icon
revenue
Fixed in 1.2.14

References

CVE
CVE-2025-62070
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/bdbb9f2b-dbfa-4f6a-b7df-97e47683a80e

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Legion Hunter
Verified
No
WPVDB ID
1bf70770-2f23-4d90-a18b-4fae47376927

Timeline

Publicly Published
2025-10-16 (about 10 months ago)
Added
2025-10-23 (about 10 months ago)
Last Updated
2025-10-23 (about 10 months ago)

Other

Published
Title
Published
2026-03-20
Title
Build App Online <= 1.0.23 - Missing Authorization to Arbitrary Post Author Modification via 'build-app-online-update-vendor-product' AJAX Action
Published
2024-09-30
Title
Popup Maker < 1.20.0 - Missing Authorization
Published
2025-03-03
Title
Animation Addons for Elementor Pro < 1.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation
Published
2021-12-22
Title
Contact Form & Lead Form Elementor Builder < 1.6.8 - Subscriber+ Arbitrary Lead Deletion
Published
2026-03-30
Title
Truebooker - Appointment Booking and Scheduler Plugin < 1.1.5 - Sensitive Information Exposure via Views Files