{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25365", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-02-02T12:52:55.300Z", "datePublished": "2026-03-25T16:14:45.681Z", "dateUpdated": "2026-03-25T16:14:45.681Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "kargo-takip-turkiye", "product": "Kargo Takip", "vendor": "\u00d6zg\u00fcr KARALAR", "versions": [{"changes": [{"at": "0.2.4", "status": "unaffected"}], "lessThanOrEqual": "< 0.2.4", "status": "affected", "version": "n/a", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Nabil Irawan | Patchstack Bug Bounty Program"}], "datePublic": "2026-03-25T17:12:24.212Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Missing Authorization vulnerability in \u00d6zg\u00fcr KARALAR Kargo Takip kargo-takip-turkiye allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Kargo Takip: from n/a through < 0.2.4.</p>"}], "value": "Missing Authorization vulnerability in \u00d6zg\u00fcr KARALAR Kargo Takip kargo-takip-turkiye allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kargo Takip: from n/a through < 0.2.4."}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "Missing Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-03-25T16:14:45.681Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/kargo-takip-turkiye/vulnerability/wordpress-kargo-takip-plugin-0-2-4-broken-access-control-vulnerability?_s_id=cve"}], "title": "WordPress Kargo Takip plugin < 0.2.4 - Broken Access Control vulnerability"}}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in \u00d6zg\u00fcr KARALAR Kargo Takip kargo-takip-turkiye allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kargo Takip: from n/a through < 0.2.4."}], "id": "CVE-2026-25365", "lastModified": "2026-03-25T17:16:47.420", "metrics": {}, "published": "2026-03-25T17:16:47.420", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/Wordpress/Plugin/kargo-takip-turkiye/vulnerability/wordpress-kargo-takip-plugin-0-2-4-broken-access-control-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "audit@patchstack.com", "type": "Primary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-03-25T17:59:53.568915+00:00", "value": {"mitigation_remediation": ["Upgrade the Kargo Takip plugin to version 0.2.4 or later.", "Verify that the WordPress installation and all related plugins are on their latest secure versions.", "Check the site\u2019s access control settings to ensure no unintended permissions remain exposed."], "summary": {"action": "Immediate Patch", "impact": "Unauthorized Access"}, "threat_synthesis": {"affected_systems": "Deployments that use the Kargo Takip plugin run at risk when installed on a WordPress site, particularly versions predating 0.2.4. The product is distributed by \u00d6zg\u00fcr\u202fKARALAR and is intended for Turkish cargo tracking integration. Any WordPress installation featuring the plugin before the 0.2.4 update is affected; newer releases are not. Administrators should verify the exact plugin version in use and confirm whether it falls within the vulnerable range.", "description_and_impact": "A missing authorization flaw in the \u00d6zg\u00fcr\u202fKARALAR Kargo Takip WordPress plugin allows attackers to gain unauthorized access to protected resources by exploiting incorrectly configured access control security levels. The vulnerability means that users who do not have proper permissions can potentially view or manipulate tracking data that should be restricted, compromising the confidentiality and integrity of delivery information. The weakness is classified as a broken access control issue, preventing the separation of duties expected by the application.", "risk_and_exploitability": "The CVE record does not provide a CVSS score or EPSS likelihood, and the vulnerability is not included in the CISA KEV catalog, indicating limited publicly documented exploitation. Still, the nature of the flaw allows remote actors to traverse authentication barriers without additional credentials, suggesting a potentially high impact if the plugin handles sensitive logistics data. Attackers would need to target the WordPress site and interact with the plugin\u2019s API or web interface, a path that is typically reachable over the network. Organisations with unpatched deployments should treat this as a significant risk until an update is applied."}}}}, "created": "2026-03-25T21:44:51.037711+00:00", "updated": "2026-03-25T21:44:51.037764+00:00", "vendors": []}