CVE-2025-62737: 
WordPress vulnerability analysis and mitigation

CVE-2025-62737 is a Sensitive Data Exposure vulnerability (CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere) in the Image Cleanup WordPress plugin by opicron. It affects all versions up to and including 1.9.2, allowing unauthenticated remote attackers to retrieve embedded sensitive data. The vulnerability was reported by Nabil Irawan on November 4, 2025, and published by Patchstack on December 4, 2025. It carries a CVSS v3.1 base score of 5.3 (Medium) (Patchstack).

The vulnerability is classified under CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere) and maps to OWASP Top 10 category A5: Security Misconfiguration. The plugin fails to properly restrict access to sensitive system information, enabling unauthenticated network-based attackers to retrieve embedded sensitive data without any user interaction or elevated privileges. The attack vector is network-accessible, requires low complexity, and no authentication, making it trivially reachable by any remote actor (Patchstack).

Successful exploitation allows an unauthenticated attacker to view sensitive information that is normally restricted from regular users, resulting in a low confidentiality impact with no integrity or availability impact. The exposed data could be leveraged to identify further weaknesses in the target WordPress installation, potentially facilitating follow-on attacks such as privilege escalation or targeted exploitation of other vulnerabilities. The scope is limited to the affected WordPress site running the vulnerable plugin (Patchstack).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack classifies this as low priority, noting it is unlikely to be exploited, though vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress plugins at scale (Patchstack).

As of the time of disclosure, no official patch is available for the Image Cleanup plugin (versions ≤ 1.9.2). Site administrators are advised to deactivate and remove the plugin until a patched version is released by the developer (opicron). Alternatively, hosting providers or web developers can be consulted for interim protective measures. Patchstack users may benefit from virtual patching through the Patchstack platform as an immediate mitigation (Patchstack).