CVE-2025-64242: 
WordPress vulnerability analysis and mitigation

CVE-2025-64242 is a Missing Authorization (Broken Access Control) vulnerability in the WordPress plugin Easy Property Listings by Merv Barrett. It allows authenticated users with low privileges (Subscriber level) to exploit incorrectly configured access control security levels, potentially performing actions beyond their intended permissions. The vulnerability affects all versions of the plugin through 3.5.22, with version 3.5.23 being the patched release. It was reported on November 12, 2025, and publicly disclosed on December 12–16, 2025, with a CVSS v3.1 base score of 4.3 (Medium) (Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning one or more plugin functions fail to perform adequate authorization checks before executing privileged actions. An authenticated attacker with Subscriber-level access can send crafted network requests to trigger these unprotected functions, bypassing intended access controls. No user interaction is required beyond authentication, and attack complexity is low. The flaw maps to OWASP Top 10 category A1: Broken Access Control (Patchstack).

Successful exploitation allows a low-privileged authenticated user to perform actions or access data that should be restricted to higher-privileged roles. Based on the updated CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), the primary impact is on integrity — an attacker may be able to modify data or trigger restricted plugin functionality — with no direct confidentiality or availability impact. The scope is limited to the affected WordPress installation and does not extend to the underlying server or other systems (Patchstack).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.017%, indicating a very low probability of exploitation in the near term. The vulnerability requires authenticated access (Subscriber level), which limits opportunistic exploitation. Patchstack classifies this as low priority with no impactful threat, and it is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Patchstack).

The vendor has released a patched version of the Easy Property Listings WordPress plugin. Site administrators should update to version 3.5.23 or later immediately to remediate this vulnerability. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard. If an immediate update is not possible, restricting user registration or limiting Subscriber-level accounts on the affected WordPress site can reduce exposure (Patchstack).