CVE-2025-63008: 
WordPress vulnerability analysis and mitigation

CVE-2025-63008 is a Missing Authorization (Broken Access Control) vulnerability in the weDevs WP ERP WordPress plugin, affecting versions up to and including 1.16.7. It allows unauthenticated remote attackers to exploit incorrectly configured access control security levels, potentially performing unauthorized actions. The vulnerability was reported by researcher Legion Hunter on November 4, 2025, and published by Patchstack on December 4, 2025, with CVE assignment on December 9, 2025. It carries a CVSS v3.1 base score of 5.3 (Medium) (Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning one or more functions within the WP ERP plugin fail to perform adequate authorization checks before executing privileged operations. This allows unauthenticated network-based attackers (no user interaction or special privileges required) to invoke functionality that should be restricted to higher-privileged roles. The attack complexity is low, making it straightforward to exploit once a vulnerable endpoint is identified (Patchstack).

Successful exploitation results in a limited integrity impact — attackers can perform unauthorized write or modification actions within the WP ERP plugin without authentication. There is no direct confidentiality or availability impact per the CVSS scoring. While the individual impact is low, Patchstack notes that vulnerabilities of this class are commonly used in mass-exploit campaigns targeting thousands of WordPress sites simultaneously, regardless of site size or traffic (Patchstack).

No public proof-of-concept exploit code or confirmed in-the-wild exploitation has been reported for CVE-2025-63008. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack classifies this as low priority with unlikely exploitation impact, though the unauthenticated attack vector and low complexity make it theoretically accessible to automated scanning tools (Patchstack).

The vulnerability is patched in WP ERP version 1.16.8. Site administrators should update the WP ERP plugin to version 1.16.8 or later immediately. If an immediate update is not possible, site owners should contact their hosting provider or web developer for assistance. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard (Patchstack).

Patchstack, which discovered and disclosed the vulnerability through researcher Legion Hunter, classifies it as low priority with no significant impactful threat. No notable vendor statements, researcher commentary beyond the initial disclosure, or significant media coverage has been identified for this vulnerability.