CVE-2025-64270: 
WordPress vulnerability analysis and mitigation

CVE-2025-64270 is a Sensitive Data Exposure vulnerability in the Masteriyo LMS WordPress plugin (learning-management-system) that allows authenticated attackers with low privileges to retrieve embedded sensitive system information. It is classified under CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere) and affects all versions of the plugin through 2.0.3. The vulnerability was published on December 18, 2025, and was reported by Patchstack. It carries a CVSS v3.1 base score of 6.5 (Medium) (Feedly, Patchstack).

The root cause is classified as CWE-497 — Exposure of Sensitive System Information to an Unauthorized Control Sphere — meaning the plugin exposes internal system or configuration data that should not be accessible to regular authenticated users. The attack vector is network-based, requires low privileges (authenticated user), low attack complexity, and no user interaction, making it straightforward to exploit once an attacker has any valid account on the WordPress site. The exploitation technique aligns with CAPEC-170 (Web Application Fingerprinting), suggesting the exposed data could be used to retrieve embedded sensitive configuration or environment details from the LMS plugin. No public proof-of-concept code has been identified at this time (Feedly, Patchstack).

Successful exploitation results in a high confidentiality impact with no effect on integrity or availability. An authenticated attacker with minimal privileges can retrieve sensitive system information embedded within the Masteriyo LMS plugin, which could include configuration details, API keys, internal paths, or other data that could facilitate further attacks such as privilege escalation or targeted exploitation of the WordPress environment. The scope is unchanged, meaning the impact is confined to the vulnerable component, but the exposed data could serve as a stepping stone for broader compromise (Feedly).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-64270 as of the available data. The EPSS score is very low at approximately 0.018%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Feedly).

Users should update the Masteriyo LMS WordPress plugin to a version beyond 2.0.3, as all versions up to and including 2.0.3 are affected. Check the official WordPress plugin repository or the Masteriyo vendor site for the latest patched release. As an interim measure, site administrators should restrict plugin access to trusted authenticated users only and monitor for unexpected API or data retrieval requests. Disabling the plugin until a patch is applied is advisable for high-risk environments (Patchstack).