CVE-2025-24757: 
WordPress vulnerability analysis and mitigation

CVE-2025-24757 is a Missing Authorization (Broken Access Control) vulnerability combined with Cross-Site Scripting (XSS) in the AndonDesign uDesign WordPress theme. It affects uDesign versions from n/a through 4.11.2. The vulnerability was published on July 4, 2025, and carries a CVSS v3.1 base score of 6.5 (Medium) (Red Hat CVE, ENISA EUVD).

The vulnerability is classified under CWE-862 (Missing Authorization) and CWE-79 (Improper Neutralization of Input During Web Page Generation / Cross-Site Scripting). The missing authorization flaw allows authenticated users with low privileges to perform actions that should be restricted, while the XSS component enables injection of malicious scripts into web pages viewed by other users. Exploitation requires network access, low privileges, and user interaction (e.g., a victim visiting or interacting with a crafted page), with the scope of impact extending beyond the vulnerable component (Red Hat CVE, Patchstack).

Successful exploitation can result in low-level confidentiality, integrity, and availability impacts on the affected WordPress site. An attacker with low-privilege access could bypass authorization controls to perform unauthorized actions and inject persistent or reflected malicious scripts, potentially leading to session hijacking, credential theft, or defacement affecting other users who interact with the compromised content (Red Hat CVE, ENISA EUVD).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for CVE-2025-24757. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.033%, indicating a low probability of exploitation in the near term (Red Hat CVE).

Users of the AndonDesign uDesign WordPress theme should update to a version beyond 4.11.2 to remediate this vulnerability. Site administrators should review user roles and restrict low-privilege accounts where possible. Monitoring WordPress admin logs for unexpected actions by low-privilege users is also recommended as a compensating control (Patchstack, Red Hat CVE).