CVE-2025-62147: 
WordPress vulnerability analysis and mitigation

CVE-2025-62147 is a Missing Authorization (Broken Access Control) vulnerability in the Realbig WordPress plugin developed by Nik Melnik (nikmelnik). It allows unauthenticated remote attackers to exploit incorrectly configured access control security levels, potentially performing unauthorized actions. All versions of the plugin through 1.1.3 are affected. The vulnerability was published on December 31, 2025, and assigned a CVSS v3.1 base score of 5.3 (Medium) by Patchstack (Patchstack, Red Hat CVE).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether a requesting user has the necessary permissions before executing certain actions or exposing functionality. The attack vector is network-based, requires no authentication, no user interaction, and low attack complexity, making it trivially exploitable by any remote actor. The specific plugin endpoints or functions lacking authorization checks have not been publicly detailed in available sources, but the vulnerability class typically involves REST API routes or AJAX handlers registered without capability checks (Patchstack, Red Hat CVE).

Successful exploitation results in a limited integrity impact — unauthenticated attackers can perform unauthorized write-level actions on affected WordPress sites running the vulnerable Realbig plugin. Confidentiality and availability are not directly impacted according to the CVSS assessment. The scope is limited to the affected plugin's functionality, but depending on what actions are exposed without authorization, this could allow content manipulation or unauthorized configuration changes on the WordPress site (Red Hat CVE, Patchstack).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for CVE-2025-62147. The EPSS score is approximately 0.028%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Red Hat CVE).

Users should update the Realbig WordPress plugin to a version beyond 1.1.3 if a patched release is available from the plugin author (Nik Melnik). If no patched version is available, site administrators should consider deactivating and removing the plugin until a fix is released. Additionally, deploying a Web Application Firewall (WAF) with WordPress-specific rules can help block unauthorized access attempts targeting plugin endpoints (Patchstack).