Security readout for executives and security teams
Plain-English summary
A WordPress WooCommerce login/registration plugin has a critical access-control flaw. If a site uses the affected plugin version, an unauthenticated remote attacker may be able to bypass intended authorization checks, risking account, data, and site integrity. Public sources do not confirm active exploitation.
Executive priority
Treat as urgent for any ecommerce site using this plugin. The worst-case impact is high confidentiality, integrity, and availability compromise, but exposure depends on whether the plugin is installed and vulnerable.
Technical view
CVE-2025-69052 is a missing authorization issue (CWE-862) in FmeAddons Registration & Login with Mobile Phone Number for WooCommerce. The CVSS 3.1 score is 9.8 with network attack vector, low complexity, no privileges, and no user interaction. Sources list affected versions through 1.3.1.
Likely exposure
Exposure is limited to WordPress/WooCommerce sites that have the FmeAddons Registration & Login with Mobile Phone Number for WooCommerce plugin installed at version 1.3.1 or earlier.
Exploitation context
The vulnerability is remotely reachable and requires no authentication or user interaction according to the CVSS vector. The provided sources do not state that exploitation is active, and the CVE is not listed as KEV in the bundle.
Researcher notes
Public data identifies broken access control but does not provide implementation details, exploit indicators, or a named fixed version in the supplied sources. Note the Patchstack URL title references 1.2.9 while the CVE bundle states through 1.3.1; verify with vendor records.
Mitigation direction
- Inventory WordPress sites for the affected plugin and version.
- Check the vendor, WordPress plugin page, and Patchstack for current remediation guidance.
- Update or disable the plugin if a fixed version or vendor guidance is available.
- Restrict administrative access and review WooCommerce account-security controls.
Validation and detection
- Confirm whether the plugin package registration-login-with-mobile-phone-number is installed.
- Record installed plugin versions and compare against affected versions through 1.3.1.
- Review web and WordPress logs for unusual registration, login, or account changes.
- Monitor Patchstack and CVE records for updated fix or exploitation details.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-862: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-69052 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source materials
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Authorization
Missing Authorization represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.