CVE-2025-58629: 
WordPress vulnerability analysis and mitigation

The CVE-2025-58629 is a Missing Authorization vulnerability discovered in the Miraculous WordPress theme, affecting versions prior to 2.0.9. The vulnerability was first reported on September 1, 2025, by security researcher Tran Nguyen Bao Khanh from VCI - VNPT Cyber Immunity (Wordfence Report, Patchstack Database).

The vulnerability is classified as a Missing Authorization to Unauthenticated Arbitrary Content Deletion issue. It received a CVSS score of 7.5 (High), falling under the OWASP Top 10 category A4: Insecure Design. The vulnerability allows unauthenticated access to content deletion functions (Patchstack Database).

When exploited, this vulnerability could allow malicious actors to delete content from affected websites, including pictures, posts, or pages, without requiring authentication. The high CVSS score of 7.5 indicates significant potential impact on affected systems (Patchstack Database).

The vulnerability has been patched in version 2.0.9 of the Miraculous theme. Users are strongly advised to update to version 2.0.9 or later immediately. Additionally, Patchstack has issued a mitigation rule to block potential attacks until users can update to the fixed version (Patchstack Database).