CVE-2025-58004: 
WordPress vulnerability analysis and mitigation

CVE-2025-58004 is a Missing Authorization vulnerability in the SmartDataSoft DriCub (dricub-driving-school) WordPress theme that allows unauthenticated attackers to exploit incorrectly configured access control security levels. It affects DriCub versions from the initial release through 2.9 (inclusive). The vulnerability was published on September 22, 2025, and carries a CVSS v3.1 base score of 5.3 (Medium) (Red Hat CVE, Wordfence).

The root cause is classified as CWE-862 (Missing Authorization), meaning the theme fails to properly verify whether a requesting user has the necessary permissions before performing certain actions. The attack vector is network-based, requires no authentication, no user interaction, and low attack complexity, making it trivially exploitable by any remote attacker. The flaw falls under the broader category of Broken Access Control, where restricted functionality or data can be accessed without proper authorization checks (Red Hat CVE, Wordfence).

Successful exploitation results in a low integrity impact with no confidentiality or availability impact, meaning an unauthenticated attacker can perform unauthorized actions or modifications within the scope of the vulnerable theme's functionality. The vulnerability does not expose sensitive data or cause service disruption, but could allow unauthorized content manipulation or configuration changes on affected WordPress sites running the DriCub theme (Red Hat CVE).

There is no public evidence of active in-the-wild exploitation or weaponized exploit code for CVE-2025-58004 at this time. The EPSS score is approximately 0.028%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported (Red Hat CVE, Wordfence).

WordPress site administrators running the DriCub theme should update to a version beyond 2.9 if a patched release is available from SmartDataSoft, or remove the theme if no patch has been issued. As a general workaround, restricting access to WordPress admin and theme-related endpoints via web application firewall (WAF) rules can reduce exposure. Monitoring for unexpected unauthenticated requests to theme-specific endpoints is also advisable (Wordfence).

The vulnerability was noted in Wordfence's weekly WordPress vulnerability report for the period of September 22–28, 2025, as part of a broader roundup of WordPress theme and plugin issues. No significant independent researcher commentary or media coverage beyond standard vulnerability tracking has been identified (Wordfence).