CVE-2025-30772

🗓️ 27 Mar 2025 10:54:37Reported by PatchstackType

cve🔗 web.nvd.nist.gov👁 60 Views🌐 WEB

Missing Authorization vulnerability in WPClever WPC Smart Upsell Funnel allows Privilege Escalation.

Reporter	Title	Published	Views	Family All 12
GithubExploit	Exploit for CVE-2025-30772	28 Mar 202510:29	–	githubexploit
Circl	CVE-2025-30772	28 Mar 202516:00	–	circl
CNNVD	WordPress plugin WPC Smart Upsell Funnel for WooCommerce 安全漏洞	27 Mar 202500:00	–	cnnvd
Cvelist	CVE-2025-30772 WordPress WPC Smart Upsell Funnel for WooCommerce plugin <= 3.0.4 - Arbitrary Option Update to Privilege Escalation vulnerability	27 Mar 202510:54	–	cvelist
EUVD	EUVD-2025-8401	3 Oct 202520:07	–	euvd
NVD	CVE-2025-30772	27 Mar 202511:15	–	nvd
Packet Storm News	WordPress WPC Smart Upsell Funnel for WooCommerce 3.0.4 Privilege Escalation	28 Mar 202500:00	–	packetstormnews
Patchstack	WordPress WPC Smart Upsell Funnel for WooCommerce plugin <= 3.0.4 - Arbitrary Option Update to Privilege Escalation vulnerability	27 Mar 202521:34	–	patchstack
Positive Technologies	PT-2025-13058 · Woocommerce · Wpc Smart Upsell Funnel	27 Mar 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-30772	29 Mar 202511:35	–	redhatcve

Vulners

Node

wpclever wpc_smart_upsell_funnel_for_woocommerceRange≤3.0.4wordpress

[
  {
    "collectionURL": "https://wordpress.org/plugins",
    "defaultStatus": "unaffected",
    "packageName": "wpc-smart-upsell-funnel",
    "product": "WPC Smart Upsell Funnel for WooCommerce",
    "vendor": "WPClever",
    "versions": [
      {
        "changes": [
          {
            "at": "3.0.5",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "3.0.4",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
patchstack	www.patchstack.com/database/Wordpress/Plugin/wpc-smart-upsell-funnel/vulnerability/wordpress-wpc-smart-upsell-funnel-for-woocommerce-plugin-3-0-4-arbitrary-option-update-to-privilege-escalation-vulnerability

Parameter	Position	Path	Description	CWE
action	request body	wp-admin/admin-ajax.php	Unauthenticated-privileged AJAX endpoint allows updating options without proper authorization (e.g., default_role) enabling privilege escalation	CWE-862

28 Apr 2026 16:11Current

7.2High risk

Vulners AI Score7.2

CVSS 3.18.8

EPSS0.00383

SSVC

CWE-862