CVE-2025-23504: 
WordPress vulnerability analysis and mitigation

CVE-2025-23504 is an Authentication Bypass Using an Alternate Path or Channel vulnerability (CWE-288) in the RiceTheme Felan Framework WordPress plugin, classified as "Broken Authentication." It affects all versions of the Felan Framework plugin through and including version 1.1.3. The vulnerability was reported by researcher 0xd4rk5id3 on August 27, 2025, and publicly disclosed by Patchstack on January 8, 2026. It carries a CVSS v3.1 base score of 9.8 (Critical), assessed by CISA-ADP (Patchstack, NVD).

The vulnerability is rooted in improper authentication controls within the Felan Framework WordPress plugin, classified under CWE-288 (Authentication Bypass Using an Alternate Path or Channel). An unauthenticated remote attacker can exploit alternate code paths or channels within the plugin to bypass standard authentication mechanisms, effectively abusing the authentication process without valid credentials. No user interaction or elevated privileges are required, and the attack can be conducted entirely over the network. The vulnerability is categorized under OWASP Top 10 A3: Injection (Broken Authentication context) and has been assigned PSID e52ff3d1da56 by Patchstack (Patchstack).

Successful exploitation allows an unauthenticated attacker to perform actions normally restricted to higher-privileged users, potentially gaining administrative access to the affected WordPress site. The vulnerability carries high confidentiality, integrity, and availability impacts — an attacker could read sensitive data, modify site configurations or content, install malicious plugins or backdoors, and disrupt site availability. Given the WordPress ecosystem's scale, this type of vulnerability is commonly leveraged in mass-exploit campaigns targeting thousands of sites regardless of their traffic or popularity (Patchstack).

As of the time of disclosure, there is no public proof-of-concept exploit code and no confirmed evidence of in-the-wild exploitation (Feedly). The EPSS score is approximately 0.024%, indicating a currently low probability of exploitation in the near term. No official patch is available as of the disclosure date, which increases risk for unprotected sites. Patchstack has issued a virtual patching/mitigation rule to block exploitation attempts for users of their service (Patchstack). The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

As of the disclosure date, no official patch from the plugin developer (RiceTheme) is available for the Felan Framework plugin. Site administrators should remove or deactivate the plugin until a patched version is released. Patchstack users benefit from a virtual mitigation rule that blocks exploitation attempts without requiring a code-level fix. Additionally, implementing network-level access controls to restrict exposure of the WordPress admin interface and monitoring authentication logs for anomalous access patterns are recommended interim measures (Patchstack).

The vulnerability was noted by TheHackerWire on social media platforms including Mastodon and infosec.exchange shortly after disclosure in January 2026, indicating some community awareness (infosec.exchange). No significant vendor statements or in-depth researcher write-ups beyond the Patchstack advisory have been identified.