CVE-2025-58835
BaseFortify
Publication date: 2025-09-05
Last updated on: 2026-04-23
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| calliko | bonus_for_woo | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-1284 | The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in the WordPress plugin 'Bonus for Woo' (up to version 7.4.1) is an improper validation of specified quantity in input, allowing access to functionality that is not properly constrained by Access Control Lists (ACLs). It falls under the OWASP Top 10 category A4: Insecure Design. The issue requires no authentication to exploit and is considered low severity with a CVSS score of 5.3. Essentially, attackers can exploit this flaw to access certain plugin functions that should be restricted. [1]
How can this vulnerability impact me? :
The impact of this vulnerability is low severity and primarily allows attackers to access functionality that should be restricted, potentially leading to unauthorized actions within the plugin. However, it does not affect confidentiality or availability, only integrity to a limited extent. Exploitation is opportunistic and automated rather than targeted. There is no direct impact on data confidentiality or system availability, but unauthorized access to plugin functions could lead to misuse or manipulation of plugin behavior. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of this vulnerability is challenging because plugin-based malware scanners may be unreliable. There are no specific commands provided for detection. Users are advised to seek professional incident response or hosting provider assistance if compromise is suspected. [1]
What immediate steps should I take to mitigate this vulnerability?
Since no official fix or patched version is currently available, the recommended immediate mitigation is to apply Patchstack's virtual patching (vPatching), which automatically neutralizes the threat without performance loss. Additionally, monitoring for suspicious activity and consulting professional incident response or hosting providers is advised. [1]