CVE-2025-62150: 
WordPress vulnerability analysis and mitigation

CVE-2025-62150 is a Missing Authorization vulnerability in the Themesawesome History Timeline WordPress plugin (slug: timeline-awesome) that allows low-privileged authenticated users to exploit incorrectly configured access control security levels. It affects all versions of the plugin from n/a through 1.0.6. The vulnerability was published on December 31, 2025, and assigned by Patchstack. It carries a CVSS v3.1 base score of 4.3 (Medium) (Patchstack, Red Hat CVE).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether an authenticated user has the appropriate permissions before allowing access to certain functionality. An attacker with a low-privileged WordPress account (e.g., subscriber or contributor) can send network requests to restricted plugin endpoints without proper authorization checks, enabling unauthorized data modification. No user interaction is required, and attack complexity is low, making exploitation straightforward for any authenticated user (Patchstack).

Successful exploitation results in a limited integrity impact — authenticated low-privileged users can modify data managed by the History Timeline plugin without authorization. There is no confirmed confidentiality or availability impact. The scope is limited to the affected WordPress installation, and lateral movement potential is low given the constrained impact (Patchstack).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for CVE-2025-62150. The EPSS score is approximately 0.026% (0.000260), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Feedly).

Users should update the History Timeline WordPress plugin (timeline-awesome) to a version beyond 1.0.6 if a patched release is available from Themesawesome. If no patched version is yet available, site administrators should consider deactivating and removing the plugin until a fix is released. Restricting site registration and limiting low-privileged user accounts can reduce the attack surface in the interim (Patchstack).