CVE-2025-64238: 
WordPress vulnerability analysis and mitigation

CVE-2025-64238 is a Missing Authorization (Broken Access Control) vulnerability in the WordPress plugin WPS Bidouille by NicolasKulka, affecting all versions up to and including 1.33.1. The flaw allows authenticated users with low privileges (Subscriber level) to perform actions that should be restricted to higher-privileged roles. It was reported by researcher Legion Hunter on November 2, 2025, published by Patchstack on December 2, 2025, and assigned a CVE on December 16, 2025. The vulnerability carries a CVSS v3.1 base score of 4.3 (Medium) (Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether a requesting user has the necessary permissions before executing a privileged function. This is consistent with a missing or improperly implemented authorization or nonce token check in one or more plugin functions, allowing a low-privileged authenticated user (e.g., a Subscriber) to trigger actions intended for administrators or developers. The attack vector is network-based, requires low privileges, no user interaction, and low attack complexity (Patchstack, Feedly).

Successful exploitation allows a low-privileged authenticated attacker to perform unauthorized actions that should be restricted to higher-privileged users, resulting in a limited integrity impact (CVSS integrity impact: Low). There is no direct confidentiality or availability impact based on the current CVSS assessment. The practical risk is constrained to scenarios where an attacker already holds at least a Subscriber-level account on the affected WordPress site (Patchstack).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. Patchstack classifies this as low priority with no impactful threat, and it is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Patchstack, Feedly).

The vulnerability is patched in WPS Bidouille version 1.33.2. Site administrators should update the plugin to version 1.33.2 or later immediately. If an immediate update is not possible, restricting user registration or limiting Subscriber-level access on the WordPress site can reduce exposure. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard (Patchstack).