CVE-2025-64243: 
WordPress vulnerability analysis and mitigation

CVE-2025-64243 is a Missing Authorization (Broken Access Control) vulnerability in the e-plugins Directory Pro WordPress plugin, affecting all versions through 2.5.6. It allows authenticated attackers with low privileges (Subscriber level) to exploit incorrectly configured access control security levels and perform actions beyond their intended permissions. The vulnerability was reported by researcher Phat RiO on November 12, 2025, and published by Patchstack on December 12, 2025, with NVD publication on December 16, 2025. It carries a CVSS v3.1 base score of 4.3 (Medium), assigned by Patchstack (Patchstack Advisory).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the plugin fails to perform adequate authorization checks before executing certain privileged functions. This allows a low-privileged authenticated user (e.g., a Subscriber) to invoke functionality that should be restricted to higher-privileged roles. The attack vector is network-based, requires low privileges, no user interaction, and low attack complexity, making it straightforward to exploit for any authenticated WordPress user on an affected site (Patchstack Advisory).

Successful exploitation results in a low integrity impact, allowing an authenticated low-privileged attacker to perform unauthorized actions within the Directory Pro plugin that should be restricted to higher-privileged users. There is no confidentiality or availability impact identified. The scope is limited to the affected WordPress installation, with no evidence of lateral movement potential beyond the plugin's functionality (Patchstack Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack classifies this as low priority and notes it is unlikely to be exploited, though they note that vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress sites (Patchstack Advisory).

As of the time of disclosure, no official patch was available for the Directory Pro plugin from e-plugins — the Patchstack advisory notes "No official patch available" for versions through 2.5.6. Site administrators should monitor the plugin's update channel for a patched release and apply it immediately when available. In the interim, consider disabling the plugin if it is not critical to site operations, or restricting site registration to prevent untrusted users from obtaining Subscriber-level accounts. Patchstack users may benefit from virtual patching protections (Patchstack Advisory).