CVE-2025-63065

Authorization Bypass Through User-Controlled Key vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Media LIbrary Assistant: from n/a through <= 3.29.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://patchstack.com/database/Wordpress/Plugin/media-library-assistant/vulnerability/wordpress-media-library-assistant-plugin-3-30-broken-access-control-vulnerability?_s_id=cve

Configurations

No configuration.

History

07 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Vulnerabilidad de elusión de autorización a través de clave controlada por el usuario en el Asistente de Biblioteca de Medios de David Lingren permite explotar niveles de seguridad de control de acceso configurados incorrectamente. Este problema afecta a Asistente de Biblioteca de Medios: desde n/a hasta 3.29.

Information

Published : 2025-12-09 16:18

Updated : 2026-10-07 20:10

NVD link : CVE-2025-63065

Mitre link : CVE-2025-63065

CVE.ORG link : CVE-2025-63065

JSON object : View

Products Affected

No product.

CWE

CWE-639

Authorization Bypass Through User-Controlled Key

{"id": "CVE-2025-63065", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-63065", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-09T16:32:01.045807Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "audit@patchstack.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "audit@patchstack.com", "affectedData": [{"vendor": "David Lingren", "product": "Media LIbrary Assistant", "versions": [{"status": "affected", "changes": [{"at": "3.30", "status": "unaffected"}], "version": "0", "versionType": "custom", "lessThanOrEqual": "3.29"}], "packageName": "media-library-assistant", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}]}], "published": "2025-12-09T16:18:12.170", "references": [{"url": "https://patchstack.com/database/Wordpress/Plugin/media-library-assistant/vulnerability/wordpress-media-library-assistant-plugin-3-30-broken-access-control-vulnerability?_s_id=cve", "source": "audit@patchstack.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "audit@patchstack.com", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "Authorization Bypass Through User-Controlled Key vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Media LIbrary Assistant: from n/a through <= 3.29."}, {"lang": "es", "value": "Vulnerabilidad de elusi\u00f3n de autorizaci\u00f3n a trav\u00e9s de clave controlada por el usuario en el Asistente de Biblioteca de Medios de David Lingren permite explotar niveles de seguridad de control de acceso configurados incorrectamente. Este problema afecta a Asistente de Biblioteca de Medios: desde n/a hasta 3.29."}], "lastModified": "2026-10-07T20:10:01.970", "sourceIdentifier": "audit@patchstack.com"}