CVE-2025-58627

{
  "id": "CVE-2025-58627",
  "sourceIdentifier": "[email protected]",
  "published": "2025-11-06T16:15:59.557",
  "lastModified": "2026-10-23T21:10:00.157",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Authorization Bypass Through User-Controlled Key vulnerability in kamleshyadav Miraculous Core Plugin miraculouscore allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Miraculous Core Plugin: from n/a through < 2.0.9."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de bypass de autorización a través de clave controlada por el usuario en el plugin Miraculous Core de kamleshyadav miraculouscore permite la explotación de niveles de seguridad de control de acceso configurados incorrectamente. Este problema afecta al plugin Miraculous Core: desde n/a hasta anterior a 2.0.9."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "kamleshyadav",
          "product": "Miraculous Core Plugin",
          "defaultStatus": "unaffected",
          "collectionURL": "https://themeforest.net",
          "packageName": "miraculouscore",
          "versions": [
            {
              "version": "0",
              "lessThanOrEqual": "2.0.9",
              "versionType": "custom",
              "status": "affected",
              "changes": [
                {
                  "at": "2.0.9",
                  "status": "unaffected"
                }
              ]
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-11-17T16:30:12.783404Z",
          "id": "CVE-2025-58627",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://patchstack.com/database/Wordpress/Plugin/miraculouscore/vulnerability/wordpress-miraculous-core-plugin-plugin-2-0-9-insecure-direct-object-references-idor-vulnerability?_s_id=cve",
      "source": "[email protected]"
    }
  ]
}