CVE-2025-64246: 
WordPress vulnerability analysis and mitigation

CVE-2025-64246 is a Missing Authorization (Broken Access Control) vulnerability in the "Accessibility by AudioEye" WordPress plugin developed by netopsae. It affects all versions up to and including 1.0.49, allowing authenticated attackers with low privileges (Subscriber level) to exploit incorrectly configured access control security levels. The vulnerability was reported by Nabil Irawan on November 14, 2025, and publicly disclosed on December 14–16, 2025. It carries a CVSS v3.1 base score of 4.3 (Medium), assigned by Patchstack (Patchstack).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to perform adequate authorization checks — such as capability checks or nonce token validation — before executing privileged actions. This allows a low-privileged authenticated user (e.g., a Subscriber) to invoke functionality intended for higher-privileged roles. The attack vector is network-based, requires low privileges, no user interaction, and has low attack complexity, making it straightforward to exploit for any authenticated WordPress user (Patchstack).

Successful exploitation results in a limited integrity impact, allowing an authenticated low-privileged user to perform unauthorized actions within the WordPress site that should be restricted to higher-privileged roles. There is no confidentiality or availability impact identified. The scope is limited to the affected WordPress installation, and the vulnerability is assessed as low priority with no impactful threat expected in practice (Patchstack).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack classifies this as low priority and notes it is unlikely to be exploited, though vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress plugins at scale (Patchstack).

The vulnerability is patched in version 1.1.0 of the Accessibility by AudioEye WordPress plugin. Site administrators should update the plugin to version 1.1.0 or later immediately. If an immediate update is not possible, site owners should contact their hosting provider or web developer for assistance. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard (Patchstack).