CVE-2025-62735: 
WordPress vulnerability analysis and mitigation

CVE-2025-62735 is a Sensitive Data Exposure vulnerability (CWE-497) in the WordPress User Spam Remover plugin by Joel, affecting all versions up to and including 1.1. The flaw allows unauthenticated remote attackers to retrieve embedded sensitive system information that should not be accessible to unauthorized parties. It was reported by researcher Nabil Irawan on November 4, 2025, and published by Patchstack on December 4, 2025, with CVE assignment on December 9, 2025. The vulnerability carries a CVSS v3.1 base score of 5.3 (Medium) (Patchstack).

The vulnerability is classified as CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), mapped to CAPEC-170 (Web Application Fingerprinting). The plugin exposes sensitive system or configuration data through its functionality without requiring authentication, enabling unauthenticated network-based attackers to retrieve embedded sensitive data with low attack complexity and no user interaction required. The OWASP Top 10 classification is A5: Security Misconfiguration, suggesting the plugin improperly exposes internal information due to a configuration or access-control oversight (Patchstack).

Successful exploitation allows an unauthenticated attacker to view sensitive information not normally accessible to regular users, which could be leveraged to facilitate further attacks against the WordPress installation or underlying system. The impact is limited to confidentiality (low), with no direct integrity or availability consequences. However, the exposed data could assist attackers in fingerprinting the target environment and chaining additional exploits (Patchstack).

No official patch is currently available for this vulnerability, leaving all installations running version 1.1 or earlier exposed. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. Patchstack notes that vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting thousands of WordPress sites regardless of traffic or popularity, though this specific issue is assessed as low priority and unlikely to be actively exploited. No in-the-wild exploitation, threat actor attribution, or CISA KEV catalog listing has been reported (Patchstack).

As of the disclosure date, no official patched version of the User Spam Remover plugin is available. The primary recommended action is to remove or deactivate the plugin until a patched version is released. Site owners unable to remove the plugin should consult their hosting provider or web developer for assistance, and consider using a WordPress security solution such as Patchstack to apply virtual patches. Monitoring web server access logs for unexpected requests to plugin endpoints may help detect reconnaissance activity (Patchstack).