CVE-2025-62128: 
WordPress vulnerability analysis and mitigation

CVE-2025-62128 is a Missing Authorization (Broken Access Control) vulnerability in the SiteLock Security – WP Hardening, Login Security & Malware Scans WordPress plugin. It affects all versions from n/a through 5.0.1, allowing authenticated low-privileged users to exploit incorrectly configured access control security levels. The vulnerability was published on December 30, 2025, and assigned by Patchstack. It carries a CVSS v3.1 base score of 4.3 (Medium) (Red Hat CVE, ENISA EUVD).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether an authenticated user has the appropriate permissions before allowing access to certain functionality. The attack vector is network-based, requires low privileges (any authenticated WordPress user), no user interaction, and low attack complexity. This falls under the broader category of broken access control, where restricted plugin actions or endpoints can be triggered by users who should not have permission to do so (ENISA EUVD, Red Hat CVE).

Successful exploitation results in a limited availability impact — specifically, low-privileged authenticated attackers can trigger a denial-of-service condition against the affected WordPress site. There is no confidentiality or integrity impact per the CVSS scoring. The scope is unchanged, meaning the impact is confined to the vulnerable plugin's functionality rather than enabling broader system compromise or lateral movement (ENISA EUVD).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for CVE-2025-62128. The EPSS score is approximately 0.036%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Red Hat CVE, ENISA EUVD).

The vulnerability is resolved in SiteLock Security plugin version 5.0.2 and later. WordPress site administrators should update the SiteLock Security – WP Hardening, Login Security & Malware Scans plugin to version 5.0.2 or higher immediately. As a temporary measure, restricting site registration or limiting authenticated user roles can reduce exposure until patching is possible (ENISA EUVD).