CVE-2025-58872
BaseFortify
Publication date: 2025-09-05
Last updated on: 2026-04-23
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| premiumbizthemes | simple_price_calculator | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-201 | The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Broken Access Control issue in the WordPress Simple Price Calculator Plugin (up to version 1.3). It occurs due to missing authorization, authentication, or nonce token checks in certain functions, allowing users with Contributor-level privileges to perform actions that should be restricted to higher-privileged roles. This can lead to the retrieval of embedded sensitive data without proper permission. [1]
How can this vulnerability impact me? :
The vulnerability can allow an attacker with Contributor-level access to retrieve sensitive embedded data that should be protected. This unauthorized access can lead to data exposure and potential misuse of sensitive information. Since the plugin is abandoned and has no official patch, the risk remains unless mitigated by removing the plugin or applying a virtual patch. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection involves identifying the presence of the vulnerable Simple Price Calculator plugin version 1.3 or earlier on your WordPress installation. Since the vulnerability allows actions by users with Contributor-level privileges due to broken access control, monitoring for unauthorized access attempts or privilege escalations related to this plugin is recommended. Specific commands are not provided in the resources, but you can check the plugin version via WordPress CLI with: `wp plugin list | grep simple-price-calculator` and review user roles and capabilities. Additionally, monitoring web server logs for suspicious requests targeting the plugin's functions may help detect exploitation attempts. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include removing and replacing the vulnerable Simple Price Calculator plugin, as no official patch or fixed version is available. Simply deactivating the plugin is insufficient unless a virtual patch (vPatch) is applied. Patchstack recommends applying their virtual patching solution to auto-mitigate the vulnerability. Users should also consider alternative software and seek professional incident response if compromise is suspected. [1]