CVE-2025-58627: Kamleshyadav Miraculous Core Plugin

Critical severity, CVSS 9.8. EPSS: 0.4% chance of exploitation in the next 30 days.

Authorization Bypass Through User-Controlled Key vulnerability in kamleshyadav Miraculous Core Plugin miraculouscore allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Miraculous Core Plugin: from n/a through < 2.0.9.

Affected products

• Kamleshyadav Miraculous Core Plugin: up to and including 2.0.9

Published 2025-11-06. Last modified 2026-10-07.