CVE-2025-62973: 
WordPress vulnerability analysis and mitigation

CVE-2025-62973 is a Missing Authorization (Broken Access Control) vulnerability in the Themekraft BuddyForms WordPress plugin that allows unauthenticated attackers to access functionality not properly constrained by ACLs. It affects BuddyForms versions up to and including 2.9.0. The vulnerability was reported by Nabil Irawan on September 19, 2025, and published by Patchstack on October 19, 2025. It carries a CVSS v3.1 base score of 5.3 (Medium) (Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization), corresponding to OWASP Top 10 category A1: Broken Access Control. The flaw arises from the absence of proper authorization, authentication, or nonce token checks in one or more plugin functions, allowing unauthenticated users to invoke higher-privileged actions. No authentication or special preconditions are required for exploitation — the attack is network-accessible with low complexity (Patchstack). No public proof-of-concept code has been identified at this time.

Successful exploitation results in limited confidentiality impact, allowing unauthenticated remote attackers to access restricted functionality or data that should require elevated privileges. There is no direct integrity or availability impact based on the CVSS assessment. While the individual impact is low, Patchstack notes that vulnerabilities of this class are frequently used in mass-exploit campaigns targeting thousands of WordPress sites simultaneously, regardless of site size or popularity (Patchstack).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-62973. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack classifies the priority as Low, assessing it as unlikely to be exploited in practice (Patchstack).

As of the time of disclosure, no official patch has been released by Themekraft for BuddyForms. Site administrators are advised to monitor the WordPress plugin repository for an updated version and apply it as soon as one becomes available. In the interim, disabling the BuddyForms plugin or restricting access to affected WordPress installations via firewall rules or a Web Application Firewall (WAF) such as Patchstack's virtual patching solution can reduce exposure (Patchstack).

The vulnerability was noted in the Wordfence Intelligence Weekly WordPress Vulnerability Report for the week of October 13–19, 2025, indicating routine tracking by the WordPress security community (Wordfence). No significant vendor statements, researcher commentary, or broader media coverage has been identified beyond standard vulnerability database entries.