CVE-2025-63034: 
WordPress vulnerability analysis and mitigation

CVE-2025-63034 is a Missing Authorization vulnerability in the Page View Count WordPress plugin by Steve Truman that allows authenticated attackers with low privileges to exploit incorrectly configured access control security levels. The vulnerability affects Page View Count versions up to and including 2.9.0 (NVD) / 2.8.7 (ENISA/Patchstack). It was published on December 9, 2025, and assigned by Patchstack. The CVSS v3.1 base score is 5.4 (Medium) (Feedly, ENISA EUVD).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether a requesting user has the appropriate permissions before executing sensitive operations such as modifying plugin settings. The attack vector is network-based, requires low privileges (an authenticated WordPress user), low attack complexity, and no user interaction. This allows a low-privileged authenticated user to change plugin settings they should not have access to, effectively exploiting incorrectly configured access control security levels (Feedly, Patchstack).

Successful exploitation allows a low-privileged authenticated attacker to modify plugin settings (integrity impact) and potentially cause limited availability disruption, though there is no confidentiality impact. The scope is unchanged, meaning the impact is confined to the vulnerable plugin's context within the WordPress installation. While not critical, unauthorized settings changes could disrupt page view tracking functionality or be leveraged as part of a broader attack chain against the WordPress site (Feedly).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-63034 as of the available data. The EPSS score is very low at approximately 0.017%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum a low-privileged authenticated account on the target WordPress site (Feedly).

1. Reconnaissance: Identify WordPress sites running the Page View Count plugin (versions ≤ 2.9.0) using tools like WPScan or by inspecting plugin directories.
2. Authentication: Obtain or register a low-privileged WordPress account (e.g., subscriber role) on the target site.
3. Identify vulnerable endpoint: Locate the plugin's settings-change functionality — typically an AJAX action or admin-post endpoint registered without proper capability checks.
4. Craft unauthorized request: Send a crafted HTTP POST request directly to the vulnerable endpoint (e.g., wp-admin/admin-ajax.php with the appropriate action parameter) with modified settings values, bypassing the missing authorization check.
5. Achieve unauthorized settings change: The server processes the request without verifying the user's permissions, applying the attacker-supplied settings to the Page View Count plugin (Feedly).

• Logs: WordPress access logs showing POST requests to wp-admin/admin-ajax.php or wp-admin/admin-post.php from low-privileged user accounts targeting Page View Count plugin actions outside of expected admin sessions.
• Logs: WordPress debug logs or audit logs recording unexpected plugin settings changes not initiated by an administrator.
• File System: Unexpected modifications to Page View Count plugin configuration or database option entries (e.g., wp_options table rows associated with the page-views-count plugin) at unusual times or by non-admin users.

Users should update the Page View Count plugin to a version beyond 2.9.0 (or 2.8.7 per Patchstack's advisory) as soon as a patched release is available from the plugin author Steve Truman. In the interim, site administrators should restrict plugin installation and user registration to trusted accounts, and consider temporarily deactivating the plugin if low-privileged user accounts are present on the site. Monitoring WordPress audit logs for unexpected settings changes is also recommended (Feedly, Patchstack).

The vulnerability was reported and assigned by Patchstack, a WordPress security firm, and published to the ENISA European Vulnerability Database (EUVD-2025-201988). Limited broader community discussion has been observed, consistent with the medium severity rating and low EPSS score. No notable vendor statements beyond the Patchstack advisory or significant media coverage have been identified (ENISA EUVD).