CVE-2025-31071: 
WordPress vulnerability analysis and mitigation

A Missing Authorization vulnerability was discovered in themeton HotStar – Multi-Purpose Business Theme affecting versions through 1.4. The vulnerability was reported by Tran Nguyen Bao Khanh (VCI - VNPT Cyber Immunity) on March 31, 2025, and was publicly disclosed on May 16, 2025. The vulnerability has been assigned CVE-2025-31071 and received a CVSS v3.1 base score of 5.3 (Medium) (Wiz, NVD).

The vulnerability is classified as a Missing Authorization (CWE-862) issue that allows exploiting incorrectly configured access control security levels. The CVSS vector string is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, indicating that the vulnerability can be exploited over the network, requires low attack complexity, needs no privileges or user interaction, and has a limited impact on integrity while not affecting confidentiality or availability (Wiz).

The vulnerability has a low severity impact on the system's integrity, with no impact on confidentiality or availability. The CVSS impact score is 1.4, while the exploitability score is 3.9 (Wiz).

Currently, there is no official fix available for this vulnerability. Patchstack has classified this as a low-priority issue that is unlikely to be exploited (Wiz).