CVE-2025-54005: 
WordPress vulnerability analysis and mitigation

CVE-2025-54005 is a Missing Authorization (Broken Access Control) vulnerability in the SKT Page Builder WordPress plugin by sonalsinha21. It affects all versions up to and including 4.9, allowing authenticated users with low privileges (Subscriber level) to perform actions beyond their intended authorization. The vulnerability was reported by researcher RoyTdd on April 28, 2025, and publicly disclosed by Patchstack on May 28, 2025, with the CVE published on December 16, 2025. It carries a CVSS v3.1 base score of 4.3 (Medium) (Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether an authenticated user has the appropriate permissions before executing certain privileged actions. This maps to OWASP Top 10 A1: Broken Access Control. An attacker with at minimum a Subscriber-level WordPress account can exploit this over the network without any special conditions or user interaction, by sending crafted requests to plugin endpoints that lack proper authorization checks (Patchstack). No public proof-of-concept code has been identified at this time.

Successful exploitation allows a low-privileged authenticated user (e.g., a Subscriber) to perform higher-privileged actions within the WordPress site, resulting in a limited integrity impact. Confidentiality and availability are not directly affected per the CVSS assessment. The practical risk is unauthorized modification of page builder content or settings, which could be leveraged for content defacement or unauthorized data manipulation on affected WordPress sites (Patchstack).

No active in-the-wild exploitation has been reported for CVE-2025-54005, and Patchstack rates it as low priority with no impactful threat identified. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum a valid Subscriber-level account on the target WordPress site, limiting opportunistic mass exploitation (Patchstack).

The vulnerability is patched in SKT Page Builder version 5.0. Site administrators should update the plugin to version 5.0 or later immediately. If an immediate update is not possible, restricting user registration or limiting Subscriber-level account creation can reduce exposure. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard (Patchstack).