CVE-2025-63006: 
WordPress vulnerability analysis and mitigation

CVE-2025-63006 is a Missing Authorization (Broken Access Control) vulnerability in the Metagauss EventPrime WordPress plugin, affecting all versions up to and including 4.2.4.1. It allows authenticated attackers with low privileges to exploit incorrectly configured access control security levels, performing actions beyond their intended authorization. The vulnerability was discovered by researcher "daroo" on October 7, 2025, and published by Patchstack on November 6, 2025. It carries a CVSS v3.1 base score of 4.3 (Medium) (Patchstack).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether a user has the required permissions before executing certain privileged actions. The attack vector is network-based, requiring low privileges and no user interaction, with low attack complexity. Specifically, the plugin does not enforce adequate authorization or nonce token checks on one or more functions, allowing lower-privileged or unauthenticated users to trigger higher-privileged operations (Patchstack).

Successful exploitation results in a low integrity impact with no confidentiality or availability impact, as reflected in the CVSS score. An attacker with minimal privileges could perform unauthorized actions within the EventPrime plugin — such as modifying event data or settings — that should be restricted to higher-privileged users. The scope is limited to the affected WordPress installation and does not directly enable lateral movement or sensitive data exfiltration (Patchstack).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack classifies this as low priority with unlikely exploitation impact (Patchstack).

The vulnerability is patched in EventPrime version 4.2.5.0. Site administrators should update the EventPrime plugin to version 4.2.5.0 or later immediately. If an immediate update is not possible, site owners should consult their hosting provider or web developer for assistance. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard (Patchstack).

Patchstack, which coordinated the disclosure, classifies this as a low-priority vulnerability with no impactful threat, noting it is unlikely to be exploited. No significant broader media coverage or notable researcher commentary beyond the Patchstack advisory has been identified for this CVE (Patchstack).