CVE-2025-62960: 
WordPress vulnerability analysis and mitigation

CVE-2025-62960 is a Missing Authorization (Broken Access Control) vulnerability in the "Construction Light" WordPress theme developed by Sparkle WP. It allows authenticated attackers with low privileges (Subscriber-level) to exploit incorrectly configured access control security levels, potentially performing actions beyond their intended permissions. The vulnerability affects all versions of the Construction Light theme through and including 1.6.7. It was reported by researcher Denver Jackson on September 16, 2025, and published by Patchstack on October 16, 2025, with the CVE formally assigned on December 18, 2025. The CVSS v3.1 base score is 5.4 (Medium) (Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the theme fails to perform adequate authorization checks — such as capability checks or nonce token validation — before executing privileged functions. This allows a low-privileged authenticated user (e.g., a Subscriber) to invoke functionality that should be restricted to higher-privileged roles such as administrators. The attack vector is network-based, requires low privileges, and has low attack complexity with no user interaction needed. No detailed technical write-up or proof-of-concept code has been publicly released (Patchstack).

Successful exploitation results in limited integrity and availability impacts — an authenticated low-privileged user can perform unauthorized actions or disrupt functionality that should be restricted to higher-privileged roles. There is no confidentiality impact (no data exposure), and the scope is unchanged, meaning the vulnerability does not enable privilege escalation to full administrative control or lateral movement beyond the affected WordPress installation. The practical impact is assessed as low by Patchstack, with the vulnerability considered unlikely to be exploited for high-impact attacks (Patchstack).

No public proof-of-concept exploit code has been identified, and there is no evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.036%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress sites regardless of traffic size, but rates this specific issue as low priority (Patchstack).

As of the time of disclosure, no official patch has been released by the theme developer, and the Construction Light theme had not been updated for approximately six months, suggesting it may be abandoned. Patchstack recommends removing and replacing the theme entirely as the primary remediation step. Deactivating the theme alone does not eliminate the security risk unless a Patchstack virtual patching/mitigation rule is deployed. WordPress site administrators should audit user roles to minimize the number of accounts with Subscriber-level or higher access while a replacement theme is identified (Patchstack).