CVE-2025-62955: 
WordPress vulnerability analysis and mitigation

CVE-2025-62955 is a Sensitive Data Exposure vulnerability (CWE-497) in the HappyDevs TempTool [Show Current Template Info] WordPress plugin, affecting all versions up to and including 1.3.1. The flaw allows authenticated attackers with at least Contributor-level privileges to retrieve sensitive system information — specifically, current template details — that should not be accessible to regular users. The vulnerability was reported by MD ISMAIL on September 14, 2025, and published by Patchstack on October 14, 2025, with the CVE formally assigned on December 21, 2025. It carries a CVSS v3.1 base score of 4.3 (Medium) (Patchstack, NVD).

The vulnerability is classified under CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere) and maps to CAPEC-170 (Web Application Fingerprinting). The plugin exposes current WordPress theme/template information to authenticated users who should not have access to such data, enabling a form of information disclosure that can facilitate further attacks. Exploitation requires network access and a low-privilege authenticated account (Contributor or Developer level), with no user interaction needed and low attack complexity. No public proof-of-concept code has been identified (Patchstack, NVD).

Successful exploitation allows an authenticated attacker to view the active WordPress theme/template name and related system information that is normally restricted. While the direct impact is limited to confidentiality (no integrity or availability impact), this information can be leveraged to identify specific theme vulnerabilities, facilitate targeted attacks, or assist in broader reconnaissance against the WordPress installation. The scope is unchanged, meaning the impact is confined to the vulnerable component itself (Patchstack).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-62955. The EPSS score is approximately 0.027%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that while vulnerabilities of this class can be used in mass-exploit campaigns targeting WordPress sites, this specific issue is rated low priority and considered unlikely to be exploited in isolation (Patchstack).

As of the time of disclosure, no official patched version of the TempTool [Show Current Template Info] plugin is available. The recommended immediate action is to deactivate and remove the plugin from WordPress installations running version 1.3.1 or earlier. Site administrators unable to remove the plugin should restrict contributor-level access and monitor for unauthorized access. Users should monitor the WordPress plugin repository and the Patchstack advisory for updates when a patched version becomes available (Patchstack).