CVE-2025-31643: 
WordPress vulnerability analysis and mitigation

CVE-2025-31643 is an Incorrect Privilege Assignment vulnerability in the Dasinfomedia WPCHURCH WordPress plugin that allows authenticated low-privileged attackers to escalate their privileges. It affects WPCHURCH versions from n/a through 2.7.0. The vulnerability was reported by Patchstack and published on January 7, 2026. It carries a CVSS v3.1 base score of 8.8 (High), assigned by Patchstack (Patchstack).

The vulnerability is classified as CWE-266 (Incorrect Privilege Assignment), meaning the plugin improperly assigns or validates privilege levels during certain operations, allowing a low-privileged authenticated user to gain elevated access. The attack vector is network-based, requires low privileges, no user interaction, and low attack complexity, making it straightforward to exploit for any authenticated WordPress user on an affected site. No detailed technical write-up or public proof-of-concept code has been identified at this time (Patchstack).

Successful exploitation allows an attacker with low-level authenticated access to escalate privileges and gain high-level control over the affected WordPress installation. This results in high confidentiality, integrity, and availability impact — an attacker could access sensitive site data, modify configurations or content, install malicious plugins, create administrator accounts, or disrupt site availability. The scope is limited to the affected WordPress instance, but a full site compromise could serve as a foothold for further lateral movement within a hosting environment (Patchstack).

There is no public proof-of-concept exploit code known at this time, and no evidence of active in-the-wild exploitation has been reported. The vulnerability has an EPSS score of approximately 0.023% (0.000230), indicating a low probability of exploitation in the near term. It does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Patchstack, Wordfence).

The primary remediation is to update the WPCHURCH plugin to a version beyond 2.7.0 once a patched release is made available by Dasinfomedia. In the interim, administrators should audit all user accounts with access to WPCHURCH functionality and apply the principle of least privilege. Network access controls should be implemented to restrict plugin access to authorized users only, and accounts should be monitored for unexpected privilege changes or new administrator account creation (Patchstack).

The vulnerability was included in Wordfence's weekly WordPress vulnerability report for the period of May 26–June 1, 2025, indicating it received standard tracking within the WordPress security community (Wordfence). It was also referenced in a CISA vulnerability bulletin for the week of January 5, 2026, and covered by The Hacker Wire. No significant vendor statements or notable researcher commentary beyond standard disclosure have been identified.