CVE-2025-62738: 
WordPress vulnerability analysis and mitigation

CVE-2025-62738 is a Missing Authorization (Broken Access Control) vulnerability in the Formstack Online Forms WordPress plugin developed by mmattax. It allows unauthenticated network attackers to exploit incorrectly configured access control security levels, potentially enabling unauthorized actions on affected WordPress sites. All versions up to and including 2.0.2 are affected, and no official patch has been released as of the time of disclosure. The vulnerability was reported by researcher Legion Hunter on November 5, 2025, and published by Patchstack on December 5, 2025, with CVE assignment on December 9, 2025. It carries a CVSS v3.1 base score of 5.3 (Medium) (Patchstack).

The root cause is classified as CWE-862 (Missing Authorization) — a function within the plugin lacks proper authorization, authentication, or nonce token checks, allowing unauthenticated users to invoke actions that should be restricted to higher-privileged roles. The attack vector is network-based, requires no authentication, no user interaction, and low attack complexity, making it trivially accessible to remote attackers. This maps to OWASP Top 10 A1: Broken Access Control. No detailed technical write-up or public proof-of-concept code has been published beyond the Patchstack advisory (Patchstack).

Successful exploitation allows an unauthenticated attacker to perform privileged actions within the Formstack Online Forms plugin, resulting in a low integrity impact with no confidentiality or availability impact per the CVSS assessment. In practice, this could allow unauthorized manipulation of form configurations or data managed by the plugin. Patchstack classifies this as low priority with no impactful threat currently identified, though it notes that vulnerabilities of this class are commonly used in mass-exploit campaigns targeting large numbers of WordPress sites indiscriminately (Patchstack).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported. The EPSS score is approximately 0.017%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack rates the exploitation likelihood as low, though it acknowledges that broken access control vulnerabilities in WordPress plugins are frequently targeted in automated mass-scanning campaigns (Patchstack).

As of the disclosure date, no official patched version of the Formstack Online Forms plugin is available. Patchstack recommends updating the plugin as the immediate action; if an update is unavailable, site owners should consult their hosting provider or web developer. In the interim, consider deactivating and removing the plugin until a patched version is released, or use a web application firewall (WAF) solution such as Patchstack's virtual patching to block exploitation attempts (Patchstack).