CVE-2026-25365
Missing Authorization in Kargo Takip Allows Unauthorized Access
Publication date: 2026-03-25
Last updated on: 2026-04-28
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ozgur_karalar | kargo_takip | From 0.0.0 (inc) to 0.2.4 (exc) |
| ozgur_karalar | kargo_takip | From 0.2.4 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-25365 is a medium severity Broken Access Control vulnerability found in the WordPress Kargo Takip Plugin versions prior to 0.2.4.
The vulnerability arises from missing authorization, authentication, or nonce token checks within certain plugin functions.
This flaw allows unprivileged users, such as subscribers, to perform actions that should be restricted to higher privileged roles like developers.
It is classified under the OWASP Top 10 category A1: Broken Access Control.
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized privilege escalation, allowing users without proper permissions to perform restricted actions.
Such unauthorized actions could compromise the security and integrity of your WordPress site using the Kargo Takip Plugin.
Because the vulnerability can be exploited by unprivileged users, it poses a moderate risk with potential for mass exploitation across many websites, regardless of their traffic or popularity.
Immediate remediation involves updating the plugin to version 0.2.4 or later, or applying mitigation rules provided by Patchstack.
What immediate steps should I take to mitigate this vulnerability?
The immediate remediation involves updating the Kargo Takip Plugin to version 0.2.4 or higher.
If updating is not feasible, users are advised to seek assistance from their hosting provider or web developer.
Patchstack also issued a mitigation rule to block attacks targeting this flaw until users update to the patched version.
Using automatic vulnerability mitigation and auto-updates provided by Patchstack can enhance protection.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability is a Broken Access Control issue that allows unprivileged users to perform actions reserved for higher privileged roles, potentially leading to unauthorized access or privilege escalation.
Such unauthorized access could impact compliance with common standards and regulations like GDPR or HIPAA, which require strict access controls to protect sensitive data and ensure privacy.
However, the provided information does not explicitly mention the direct effects of this vulnerability on compliance with these standards.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves missing authorization checks in the Kargo Takip WordPress plugin, allowing unprivileged users to perform restricted actions. Detection typically involves verifying if unauthorized users can access or execute privileged plugin functions.
Since this is a WordPress plugin vulnerability, detection can be done by attempting to perform actions reserved for higher privileged roles (e.g., developers) while logged in as a low-privileged user (e.g., subscriber).
Specific commands are not provided in the available resources, but general approaches include:
- Using curl or similar HTTP clients to send requests to plugin endpoints with a low-privileged user session cookie to check if restricted actions are allowed.
- Reviewing web server logs for suspicious access patterns or unauthorized attempts to access plugin functions.
- Employing vulnerability scanners or security plugins that can detect broken access control issues in WordPress plugins.
Immediate remediation is to update the plugin to version 0.2.4 or later to fix the vulnerability.