CVE-2025-0856 HIGH

CVE-2025-0856: PGS Core <= 5.8.0 - Missing Authorization via Multiple Functions

Vendor Potenza Global Solutions

Product PGS Core

Weakness CWE-862 · Missing authorization

Published May 6, 2025

Last update April 8, 2026

View on NVD All CVEs

CVSS base score

7.3/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

What the vulnerability does

01Description

The PGS Core plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on multiple functions in all versions up to, and including, 5.8.0. This makes it possible for unauthenticated attackers to add, modify, or plugin options.

Key dates

02Disclosure timeline

May 6, 2025 CVE published

April 8, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-0856 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/862.html

Related vulnerabilities

04Related CVE

CVE-2026-22348 WordPress Civic Cookie Control plugin <= 1.53 - Broken Access Control vulnerability CVE-2025-24021 iTop doesn't have mass assignment of fields in the portal form CVE-2025-69353 WordPress Proxy & VPN Blocker plugin <= 3.5.3 - Broken Access Control vulnerability CVE-2026-7621 SMTP2GO for WordPress <= 1.16.0 - Missing Authorization to Authenticated (Subscriber+) Log Read/Truncate CVE-2025-68036 WordPress CubeWP plugin <= 1.1.27 - Broken Access Control vulnerability