WordPress Plugin Vulnerabilities

WP Customer Area < 8.3.7 - Missing Authorization

Description

The plugin is vulnerable to unauthorized access due to a missing capability check on a function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized action.

Affects Plugins

Plugin icon
customer-area
Fixed in 8.3.7

References

CVE
CVE-2025-49982
URL
https://patchstack.com/database/wordpress/plugin/customer-area/vulnerability/wordpress-wp-customer-area-plugin-8-2-5-broken-access-control-vulnerability

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
domiee13
Verified
No
WPVDB ID
7d453de0-2008-49f7-9351-870d957395cd

Timeline

Publicly Published
2025-06-19 (about 1 year ago)
Added
2025-06-25 (about 1 year ago)
Last Updated
2026-10-15 (about 1 day ago)

Other

Published
Title
Published
2024-07-11
Title
ReDi Restaurant Reservation < 24.0712 - Missing Authorization
Published
2024-11-19
Title
WP Project Manager < 2.6.15 - Missing Authorization to Project Milestone and Task Creation/Deletion
Published
2023-11-01
Title
Funnelforms Free < 3.4.2 - Missing Authorization to Arbitrary Post Duplication
Published
2025-06-05
Title
Interactive Regional Map of Florida <= 1.0 - Missing Authorization
Published
2026-01-30
Title
Fitness FSE <= 1.0.6 - Missing Authorization