CVE-2025-53997: 
WordPress vulnerability analysis and mitigation

CVE-2025-53997 is a Missing Authorization (Broken Access Control) vulnerability in the Houzez WordPress theme developed by favethemes. It affects all versions of the Houzez theme up to and including 4.0.4, allowing authenticated users with low privileges (Subscriber level) to perform actions beyond their intended authorization level. The vulnerability was reported on June 11, 2025, by Tran Nguyen Bao Khanh of VCI - VNPT Cyber Immunity, and publicly disclosed on July 16, 2025, by Patchstack. It carries a CVSS v3.1 base score of 4.3 (Medium) (Patchstack, Red Hat CVE).

The root cause is classified as CWE-862 (Missing Authorization), meaning one or more functions within the Houzez theme fail to properly verify whether the requesting user has the necessary permissions before executing privileged operations. This falls under OWASP Top 10 category A1: Broken Access Control. Exploitation requires an authenticated session at the Subscriber privilege level or higher, meaning the attacker must have at minimum a basic registered account on the target WordPress site. No public proof-of-concept code has been identified at this time (Patchstack).

Successful exploitation allows a low-privileged authenticated user to perform actions that should be restricted to higher-privileged roles, resulting in unauthorized data modification (integrity impact). The CVSS vector indicates no confidentiality or availability impact, limiting the consequence primarily to unauthorized write or update operations within the Houzez theme's functionality. Given that Houzez is a real estate listing theme, this could allow attackers to manipulate property listings, agent profiles, or other theme-managed content without proper authorization (Patchstack, Red Hat CVE).

No active in-the-wild exploitation has been reported for CVE-2025-53997, and no public exploit code is currently known. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. Patchstack classifies this as low priority with no impactful threat, though it notes that vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress sites at scale. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Patchstack).

The vendor favethemes has released a patched version of the Houzez theme. Administrators should update to version 4.1.1 or later immediately to remediate this vulnerability. If an immediate update is not possible, site owners should restrict user registration or limit Subscriber-level account creation to reduce the attack surface, and consult their hosting provider or web developer for assistance (Patchstack).

The vulnerability was discovered and disclosed by Tran Nguyen Bao Khanh of VCI - VNPT Cyber Immunity and published through Patchstack's coordinated disclosure process. Patchstack issued early warnings to its customers on July 16, 2025, the same day of public disclosure. No significant broader media coverage or notable researcher commentary beyond the Patchstack advisory has been identified (Patchstack).