CVE-2025-64209: 
WordPress vulnerability analysis and mitigation

CVE-2025-64209 is a Missing Authorization (Broken Access Control) vulnerability in the StylemixThemes Masterstudy WordPress theme that allows unauthenticated attackers to access functionality not properly constrained by ACLs. It affects all Masterstudy theme versions prior to 4.8.122. The vulnerability was reported by Rafie Muhammad on September 12, 2025, and published by Patchstack on October 12, 2025. It carries a CVSS v3.1 base score of 7.5 (High) (Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization) and falls under OWASP Top 10 category A1: Broken Access Control. The root cause is a missing authorization, authentication, or nonce token check in one or more theme functions, allowing unauthenticated users to invoke higher-privileged actions. Because no authentication is required and the attack is conducted over the network with low complexity, the attack surface is broad and easily reachable by any remote attacker (Patchstack).

Successful exploitation allows unauthenticated remote attackers to access or invoke restricted functionality within the Masterstudy theme, resulting in a high confidentiality impact with no integrity or availability impact per the CVSS scoring. This could expose sensitive course data, user information, or administrative functions to unauthorized parties on affected WordPress sites. Patchstack notes that vulnerabilities of this type are commonly used in mass-exploit campaigns targeting thousands of websites simultaneously, regardless of site size or popularity (Patchstack).

No public proof-of-concept exploit code or confirmed in-the-wild exploitation has been reported at this time. The EPSS score is approximately 0.017%, indicating a currently low probability of exploitation in the near term. However, Patchstack classifies this as high priority and warns that vulnerabilities of this class are frequently leveraged in mass-exploit campaigns against WordPress sites. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Patchstack).

The vendor has released a patched version of the Masterstudy theme. Site administrators should update to version 4.8.122 or later immediately to remediate the vulnerability. As an interim measure, Patchstack has issued a virtual patching/mitigation rule for subscribers that blocks exploitation attempts until the theme is updated. If an immediate update is not possible, site owners should contact their hosting provider or web developer for assistance (Patchstack).