CVE-2025-63067: 
WordPress vulnerability analysis and mitigation

CVE-2025-63067 is a Missing Authorization (Broken Access Control) vulnerability in the Porto Theme - Functionality WordPress plugin by p-themes. It allows authenticated attackers with low privileges (Subscriber level) to exploit incorrectly configured access control security levels, potentially performing actions beyond their intended permissions. The vulnerability affects all versions of the plugin prior to 3.7.3, with the patched version being 3.7.3. It was reported on September 12, 2025, published by Patchstack on October 12, 2025, and assigned a CVSS v3.1 base score of 4.3 (Medium) (Patchstack).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether an authenticated user has the appropriate permissions before executing certain privileged actions. Specifically, a missing authorization, authentication, or nonce token check in one or more plugin functions allows a low-privileged user (e.g., Subscriber) to invoke functionality intended for higher-privileged roles. The attack vector is network-based, requires low privileges, no user interaction, and low attack complexity (Patchstack). No public proof-of-concept exploit code has been identified at this time.

Successful exploitation results in a low integrity impact with no confidentiality or availability impact, as reflected in the CVSS score. An authenticated attacker with Subscriber-level access could perform unauthorized actions within the WordPress site that are normally restricted to higher-privileged users, potentially modifying site content or settings. The scope is limited to the affected WordPress installation and does not directly enable lateral movement or sensitive data exfiltration (Patchstack).

No active in-the-wild exploitation has been reported for CVE-2025-63067, and Patchstack rates it as low priority with no impactful threat identified. The EPSS score is approximately 0.032%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack notes that broken access control vulnerabilities of this type are sometimes used in mass-exploit campaigns targeting thousands of WordPress sites regardless of their traffic or popularity (Patchstack).

The vendor has released a patched version of the Porto Theme - Functionality plugin. Site administrators should update to version 3.7.3 or later immediately. If an immediate update is not possible, site owners should contact their hosting provider or web developer for assistance. Patchstack users can enable auto-update for vulnerable plugins to automate remediation (Patchstack).

The vulnerability was discovered and reported by security researcher João Pedro S Alcântara (Kinorth) on September 12, 2025, and published by Patchstack on October 12, 2025. No significant broader media coverage or notable community discussion has been identified beyond the standard vulnerability disclosure (Patchstack).