CVE-2025-46485: 
WordPress vulnerability analysis and mitigation

A Missing Authorization vulnerability was discovered in Carlo La Pera's WP Customize Login Page WordPress plugin, affecting versions through 1.6.5. The vulnerability was disclosed on April 24, 2025, and is tracked as CVE-2025-46485. The issue allows attackers to access functionality not properly constrained by Access Control Lists (ACLs) (Patchstack).

The vulnerability is classified as a Broken Access Control issue with a CVSS v3.1 Base Score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. The vulnerability stems from missing authorization checks that could allow unprivileged users to execute certain higher privileged actions (Patchstack).

The vulnerability has been assessed as having a low severity impact. While it allows unauthorized access to certain functionality, the specific impact is limited to integrity-related concerns without affecting confidentiality or availability of the system (Patchstack).

As of the disclosure date, no official fix has been made available for this vulnerability. Given the low severity of the issue, virtual patching has been deemed unnecessary (Patchstack).