CVE-2025-62085: 
WordPress vulnerability analysis and mitigation

CVE-2025-62085 is a Missing Authorization (Broken Access Control) vulnerability in the BERTHA AI WordPress plugin (slug: bertha-ai-free) developed by Andrew Palmer. It affects all versions up to and including 1.13, allowing unauthenticated attackers to exploit incorrectly configured access control security levels. The vulnerability was reported on October 30, 2025, and published by Patchstack on November 29, 2025, with CVE assignment on December 9, 2025. It carries a CVSS v3.1 base score of 5.3 (Medium) (Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning one or more plugin functions fail to perform adequate authorization checks before executing privileged actions. This allows unauthenticated network-based attackers to invoke functionality that should be restricted to higher-privileged users, such as administrators or editors. The attack requires no user interaction, no special privileges, and low complexity to execute, making it accessible to a broad range of threat actors (Patchstack).

Successful exploitation results in a low integrity impact — an unauthenticated attacker can perform unauthorized actions within the plugin's scope that would normally require elevated privileges. There is no direct confidentiality or availability impact as assessed by the CVSS score. However, in the context of WordPress mass-exploit campaigns, such broken access control flaws can be chained with other vulnerabilities or abused to manipulate AI-generated content settings, potentially affecting site integrity at scale (Patchstack).

No public proof-of-concept exploit code has been identified at this time. The EPSS score is approximately 0.017%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class are commonly used in mass-exploit campaigns targeting WordPress sites regardless of their traffic or popularity (Patchstack).

As of the time of disclosure, no official patched version of the BERTHA AI plugin has been released — the Patchstack advisory notes "No official patch available" for versions up to and including 1.13. Site administrators should monitor the WordPress plugin repository for an updated release and apply it immediately when available. In the interim, disabling or removing the BERTHA AI plugin is the recommended workaround. Hosting providers or web developers can also be consulted for additional hardening measures (Patchstack).

The vulnerability was discovered by security researcher Legion Hunter and disclosed through Patchstack's Vulnerability Disclosure Program (PSID: 7d7a4d5152a0). Patchstack classifies it as low priority with unlikely exploitation impact. No significant vendor statements, notable researcher commentary, or broader media coverage have been identified beyond the initial Patchstack advisory (Patchstack).