CVE-2025-62152: 
WordPress vulnerability analysis and mitigation

CVE-2025-62152 is a Missing Authorization vulnerability in the ConveyThis (conveythis-translate) WordPress plugin that allows attackers with low-level privileges to exploit incorrectly configured access control security levels. It affects ConveyThis plugin versions up to and including 269.2 (NVD) / 268.10 (ENISA/Patchstack). The vulnerability was published on December 9, 2025, and assigned by Patchstack. It carries a CVSS v3.1 base score of 8.8 (High) (Feedly, ENISA EUVD).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether an authenticated user has the appropriate permissions before executing sensitive operations. An attacker with a low-privileged WordPress account (e.g., subscriber) can send network-based requests to plugin endpoints that lack proper authorization checks, thereby accessing or modifying data beyond their intended privilege level. No user interaction is required, and attack complexity is low, making this straightforward to exploit once authenticated (Feedly, Patchstack).

Successful exploitation allows a low-privileged authenticated attacker to access sensitive information, modify system data, and potentially compromise the confidentiality, integrity, and availability of the affected WordPress installation. The CVSS scoring reflects high impact across all three pillars (C:H/I:H/A:H), meaning an attacker could read protected content, alter plugin or site configuration, or disrupt site functionality. In a shared or multi-tenant WordPress environment, this could facilitate further lateral movement or privilege escalation (Feedly).

There is currently no public proof-of-concept exploit code and no evidence of in-the-wild exploitation reported as of the time of publication (Feedly). The EPSS score is approximately 0.017%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation does require a low-privileged authenticated account on the target WordPress site, which somewhat limits the attack surface compared to unauthenticated vulnerabilities.

1. Reconnaissance: Identify WordPress sites running the ConveyThis (conveythis-translate) plugin at version ≤ 269.2 using tools like WPScan or by inspecting plugin metadata in publicly accessible readme.txt files.
2. Obtain low-privileged access: Register or obtain a low-privileged WordPress account (e.g., subscriber role) on the target site, or use existing credentials.
3. Identify unprotected endpoints: Enumerate plugin AJAX actions or REST API endpoints registered by the ConveyThis plugin that lack capability checks (e.g., missing current_user_can() or nonce validation).
4. Send unauthorized requests: Craft and send HTTP requests (e.g., POST to wp-admin/admin-ajax.php with the relevant action parameter) to the vulnerable endpoint, bypassing the intended access control restrictions.
5. Achieve objective: Depending on the specific unprotected action, read sensitive plugin/site configuration data, modify translation settings, or trigger other privileged operations without proper authorization (Feedly).

• Logs: WordPress access logs showing repeated POST requests to wp-admin/admin-ajax.php with ConveyThis-specific action parameters from low-privileged user accounts; unexpected access to plugin admin endpoints by subscriber-level users.
• File System: Unexpected changes to ConveyThis plugin configuration files or WordPress options table entries related to the plugin.
• Network: Unusual outbound requests from the WordPress server to external translation or API endpoints initiated after suspicious plugin interactions.

Users should immediately update the ConveyThis plugin to a version above 269.2 (per NVD) or 268.10 (per Patchstack/ENISA), as a patch is available. As interim measures, site administrators should review and restrict user registration to trusted accounts, audit WordPress user roles and capabilities, and monitor access logs for suspicious activity targeting plugin endpoints. A broader security audit of the WordPress environment is also recommended (Feedly, Patchstack).