CVE-2025-62108: 
WordPress vulnerability analysis and mitigation

CVE-2025-62108 is a Missing Authorization (Broken Access Control) vulnerability in the SaifuMak "Add Custom Codes" WordPress plugin that allows low-privileged authenticated attackers to perform actions beyond their intended permission level. It affects all versions of the plugin through 4.80, with version 5.0 being the patched release. The vulnerability was reported by researcher Nabil Irawan on October 9, 2025, and publicly disclosed by Patchstack on December 31, 2025. It carries a CVSS v3.1 base score of 5.4 (Medium) (Patchstack, Red Hat CVE).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether an authenticated user has the appropriate permissions before executing privileged actions related to custom code management. Specifically, the plugin lacks adequate authorization, authentication, or nonce token checks on one or more functions, allowing a subscriber-level user to invoke higher-privileged operations. The minimum required privilege for exploitation is a Subscriber role on the WordPress site, making it accessible to any registered user. No public proof-of-concept exploit code has been identified at this time (Patchstack).

Successful exploitation allows a low-privileged authenticated attacker to modify custom code injected into the WordPress site (integrity impact) and potentially disrupt site availability (availability impact). There is no direct confidentiality impact identified. In practice, an attacker with Subscriber-level access could alter site-wide custom code snippets, potentially injecting malicious scripts, defacing content, or causing service disruption — though full site takeover is not directly implied by this vulnerability alone (Patchstack, Feedly).

No active in-the-wild exploitation has been reported for CVE-2025-62108, and no public exploit code is known to exist. The EPSS score is approximately 0.036%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that while vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress sites at scale, this specific issue is assessed as low priority with unlikely exploitation impact (Patchstack).

1. Reconnaissance: Identify WordPress sites running the "Add Custom Codes" plugin at version 4.80 or earlier, using tools like WPScan or by checking the plugin's readme.txt file accessible at /wp-content/plugins/add-custom-codes/readme.txt.
2. Obtain low-privileged access: Register or obtain credentials for a Subscriber-level account on the target WordPress site (e.g., via open user registration).
3. Identify unprotected endpoints: Locate the plugin's admin-facing AJAX actions or REST API endpoints that lack proper capability checks, which handle custom code creation, modification, or deletion.
4. Send unauthorized request: Craft and submit an authenticated HTTP request (with valid nonce if applicable, or exploiting the missing nonce check) to the vulnerable endpoint to add, modify, or delete custom code entries that would normally require higher privileges.
5. Achieve objective: Successfully modified custom code is injected site-wide, potentially enabling content defacement, malicious script injection, or service disruption (Patchstack).

• Logs: WordPress access logs showing POST requests to admin-ajax.php or plugin-specific REST endpoints from Subscriber-level user accounts, particularly for actions related to custom code management.
• File System: Unexpected or unauthorized changes to custom code entries stored in the WordPress database (wp_options or plugin-specific tables) that were not made by an administrator.
• Logs: WordPress audit logs (if enabled via a plugin such as WP Activity Log) recording custom code modifications by non-administrator users.
• Network: Repeated authenticated requests from the same low-privileged user account targeting plugin admin functionality outside of normal usage patterns.

The vendor has released version 5.0 of the "Add Custom Codes" plugin, which addresses this vulnerability. WordPress site administrators should update the plugin to version 5.0 or later immediately via the WordPress admin dashboard or by downloading the updated plugin from the WordPress plugin repository. As a temporary workaround if updating is not immediately possible, site administrators should disable open user registration to prevent untrusted users from obtaining Subscriber-level accounts, or deactivate the plugin until the update can be applied. Patchstack users can enable auto-update for vulnerable plugins to receive protection automatically (Patchstack).