CVE-2025-64213: 
WordPress vulnerability analysis and mitigation

CVE-2025-64213 is a Sensitive Data Exposure vulnerability (CWE-201: Insertion of Sensitive Information Into Sent Data) in the StylemixThemes MasterStudy LMS Pro WordPress plugin. It allows unauthenticated remote attackers to retrieve embedded sensitive data that should not be accessible to regular users. All versions of MasterStudy LMS Pro prior to 4.7.16 are affected. The vulnerability was reported by Rafie Muhammad on September 12, 2025, published by Patchstack on October 12, 2025, and assigned CVE-2025-64213 with a CVSS v3.1 base score of 7.5 (High) (Patchstack).

The vulnerability is classified as CWE-201 (Insertion of Sensitive Information Into Sent Data), meaning the plugin inadvertently includes sensitive data in responses sent to clients. It is exploitable over the network with low attack complexity, requires no authentication, and no user interaction, making it trivially accessible to any remote attacker. The flaw maps to OWASP Top 10 category A3: Sensitive Data Exposure. No detailed technical write-up or public proof-of-concept code has been published at this time (Patchstack).

Successful exploitation allows a malicious actor to retrieve sensitive information embedded in plugin responses that is normally restricted from regular or unauthenticated users. This exposed data could include credentials, API keys, user PII, or other confidential LMS content, and could be leveraged to facilitate further attacks against the affected WordPress site or its users. The vulnerability has no impact on integrity or availability, but the confidentiality impact is rated High (Patchstack).

No public proof-of-concept exploit code or confirmed in-the-wild exploitation has been reported for CVE-2025-64213. The EPSS score is approximately 0.018% (0.000180), indicating a low current probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack rates it as high priority, noting that vulnerabilities of this class are frequently used in mass-exploit campaigns targeting WordPress plugins at scale (Patchstack).

The vendor has released MasterStudy LMS Pro version 4.7.16, which patches this vulnerability. Site administrators should update the plugin to version 4.7.16 or later immediately. Patchstack users benefit from a virtual patching/mitigation rule that blocks exploitation attempts until the plugin is updated, and auto-update for vulnerable plugins can be enabled via the Patchstack dashboard (Patchstack).