CVE-2025-58004: 
WordPress vulnerability analysis and mitigation

A Missing Authorization vulnerability was identified in SmartDataSoft DriCub, a WordPress driving school theme, affecting versions through 2.9. The vulnerability was discovered and reported by security researcher Bonds on July 27, 2025, and was publicly disclosed on September 22, 2025 (Patchstack).

The vulnerability is classified as a Missing Authorization (CWE-862) issue that allows exploiting incorrectly configured access control security levels. It received a CVSS v3.1 base score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, indicating that it is network-accessible, requires low attack complexity, and needs no privileges or user interaction to exploit (Patchstack).

The vulnerability is categorized as a broken access control issue, which could allow an unprivileged user to execute certain higher privileged actions. While classified as having a low severity impact, it represents a security risk as it bypasses intended access control mechanisms (Patchstack).

As of September 26, 2025, no official fix has been made available for this vulnerability. The issue has been marked as having low priority for virtual patching (Patchstack).