CVE-2025-64244: 
WordPress vulnerability analysis and mitigation

CVE-2025-64244 is a Missing Authorization (Broken Access Control) vulnerability in the WordPress plugin "Restrict Elementor Widgets, Columns and Sections" developed by Codexpert, Inc. It affects all versions up to and including 1.12, allowing authenticated attackers with low privileges (Subscriber-level) to exploit incorrectly configured access control security levels. The vulnerability was reported by MD ISMAIL on November 13, 2025, and published by Patchstack on December 13–16, 2025. It carries a CVSS v3.1 base score of 4.3 (Medium), assigned by Patchstack (Patchstack).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether a requesting user has the necessary permissions before executing certain privileged actions. This falls under OWASP Top 10 A1: Broken Access Control. An authenticated attacker with Subscriber-level access can send crafted requests to trigger functionality intended for higher-privileged roles, such as modifying widget, column, or section restriction settings. No nonce token or capability check is enforced on the vulnerable function(s) (Patchstack).

Successful exploitation allows a low-privileged authenticated user (e.g., a Subscriber) to perform unauthorized actions that should be restricted to administrators or editors, specifically related to managing Elementor widget, column, and section visibility restrictions. The integrity impact is low (CVSS I:L), with no direct confidentiality or availability impact. While the individual impact is limited, Patchstack notes that vulnerabilities of this class are commonly used in mass-exploit campaigns targeting thousands of WordPress sites simultaneously (Patchstack).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. Patchstack classifies the priority as "Low" and notes the issue is unlikely to be exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an authenticated account on the target WordPress site at minimum Subscriber level (Patchstack).

As of the time of disclosure, no official patch has been released by Codexpert, Inc for the "Restrict Elementor Widgets, Columns and Sections" plugin. Patchstack recommends updating the plugin as the immediate action; if an update is unavailable, site owners should contact their hosting provider or web developer. As a workaround, administrators can disable or remove the plugin until a patched version is available, and restrict site registrations to prevent untrusted users from obtaining Subscriber-level accounts (Patchstack).