CVE-2025-62736: 
WordPress vulnerability analysis and mitigation

CVE-2025-62736 is a Missing Authorization (Broken Access Control) vulnerability in the WordPress plugin Image Cleanup by opicron, affecting all versions up to and including 1.9.2. It allows authenticated attackers with low privileges (Subscriber-level) to perform actions that should be restricted to higher-privileged users. The vulnerability was reported by Nabil Irawan on November 4, 2025, and published by Patchstack on December 4, 2025. It carries a CVSS v3.1 base score of 4.3 (Medium) (Patchstack).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether a requesting user has the necessary permissions before executing privileged functions — specifically, it lacks adequate authorization, authentication, or nonce token checks (Patchstack). The attack vector is network-based, requires low privileges (e.g., a Subscriber account), low attack complexity, and no user interaction. This maps to OWASP Top 10 category A1: Broken Access Control. No public proof-of-concept code has been identified at this time.

Successful exploitation allows a low-privileged authenticated user (Subscriber level) to execute actions intended for higher-privileged roles, resulting in a low integrity impact with no confidentiality or availability impact (Patchstack). In the context of the Image Cleanup plugin, this could allow unauthorized manipulation of image cleanup operations on the WordPress site. The scope is limited to the affected WordPress installation and does not directly enable lateral movement or sensitive data exposure.

No active in-the-wild exploitation has been reported, and the EPSS score is very low at approximately 0.017% (Feedly), indicating a low probability of near-term exploitation. No exploit kits or weaponized code are publicly known. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack classifies this as low priority, noting it is "unlikely to be exploited," though it acknowledges that broken access control vulnerabilities can be used in mass-exploit campaigns targeting WordPress sites (Patchstack).

As of the time of disclosure, no official patched version of the Image Cleanup plugin is available (Patchstack). Recommended actions include:

• Deactivate and remove the Image Cleanup plugin (versions ≤ 1.9.2) until a patched version is released.
• Restrict user registration to minimize the number of Subscriber-level accounts on the WordPress site.
• Monitor the plugin's WordPress.org page for an updated release and apply it promptly when available.
• Consider using a WordPress security solution such as Patchstack to apply virtual patches while awaiting an official fix.

Patchstack, which coordinated the disclosure, classifies this as a low-priority issue with no impactful threat, noting the vulnerability is unlikely to be exploited in targeted attacks (Patchstack). No notable researcher commentary, vendor statements beyond the Patchstack advisory, or significant media coverage has been identified for this CVE.