CVE-2025-64248: 
WordPress vulnerability analysis and mitigation

CVE-2025-64248 is a Missing Authorization (Broken Access Control) vulnerability in the emarket-design "Request a Quote" WordPress plugin, affecting all versions through 2.5.3. The flaw allows authenticated attackers with low privileges (Subscriber-level) to perform actions beyond their intended authorization level. It was reported by researcher Legion Hunter on November 16, 2025, and publicly disclosed by Patchstack on December 15–16, 2025. The vulnerability carries a CVSS v3.1 base score of 4.3 (Medium) (Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning one or more plugin functions fail to perform adequate authorization checks before executing privileged operations. An authenticated attacker with Subscriber-level access can send crafted network requests to trigger these unprotected functions, exploiting incorrectly configured access control security levels. The attack vector is network-based, requires low privileges, no user interaction, and has low attack complexity, making it straightforward to exploit for any authenticated WordPress user (Patchstack).

Successful exploitation allows a low-privileged authenticated user to perform unauthorized actions within the plugin, resulting in a limited integrity impact (e.g., modifying quote-related data or plugin settings). There is no confidentiality or availability impact based on the CVSS assessment. The scope is limited to the affected WordPress installation, with no evidence of lateral movement potential or significant data exposure risk (Patchstack).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack rates this as low priority and notes it is unlikely to be exploited, though similar broken access control issues in WordPress plugins are sometimes used in mass-exploit campaigns targeting large numbers of sites indiscriminately (Patchstack).

The vendor has released version 2.5.4 of the "Request a Quote" plugin, which patches this vulnerability. Site administrators should update the plugin to version 2.5.4 or later immediately via the WordPress admin dashboard. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard. If an immediate update is not possible, restricting user registration or limiting Subscriber-level access on the WordPress site can reduce exposure (Patchstack).