CVE-2025-39552 - WordPress Zephyr Project Manager plugin <= 3.3.200 - Broken Access Control Vulnerability

Back Back to CVE browser

MEDIUM

WordPress Zephyr Project Manager plugin <= 3.3.200 - Broken Access Control Vulnerability

Published Apr 16, 2025

5.4

MEDIUM

CVSS 3.1

EPSS 0.35%

Description

Missing Authorization vulnerability in Dylan James Zephyr Project Manager zephyr-project-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Zephyr Project Manager: from n/a through <= 3.3.200.

Affected products

Vendor Dylan James Product Zephyr Project Manager Default
unaffected
- Version
  -
  Status
  affected
  Constraints
  <=3.3.200

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Dylan James

Zephyr Project Manager

unaffected

Version	Status	Constraints
-	affected	<=3.3.200

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-862

Missing Authorization

References (2)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-11316		Advisory
https://patchstack.com/database/Wordpress/Plugin/zephyr-project-manager/vulnerability/wordpress-zephyr-project-manager-3-3-200-broken-access-control-vulnerability?_s_id=cve		vdb-entry