CVE-2025-64272: 
WordPress vulnerability analysis and mitigation

CVE-2025-64272 is a Sensitive Data Exposure vulnerability (CWE-497) in the "Email marketing for WordPress by GetResponse Official" WordPress plugin, affecting all versions up to and including 1.5.3. The flaw allows authenticated attackers with at least Subscriber-level privileges to retrieve embedded sensitive system information that should not be accessible to regular users. It was reported by researcher Bao - BlueRock on August 26, 2025, and published by Patchstack on September 25, 2025. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium) (Patchstack).

The vulnerability is classified under CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), mapped to OWASP Top 10 category A1: Broken Access Control. The plugin fails to properly restrict access to sensitive embedded data — such as API keys or configuration details — from authenticated users with low privileges (Subscriber level). An attacker with a valid WordPress account can exploit this over the network without user interaction or elevated permissions, making it straightforward to trigger (Patchstack). No public proof-of-concept code has been identified at this time.

Successful exploitation allows a low-privileged authenticated attacker to access sensitive system information — potentially including API keys or integration credentials embedded within the plugin — that is normally restricted to administrators. This exposed data could be leveraged to further compromise the WordPress site, access connected GetResponse email marketing accounts, or facilitate additional attacks against the organization's infrastructure. The impact is limited to confidentiality (no integrity or availability impact), but the exposed credentials could enable significant secondary compromise (Patchstack).

No active in-the-wild exploitation has been confirmed, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018% (0.000180), indicating a low probability of near-term exploitation. However, Patchstack notes that vulnerabilities of this type are commonly used in mass-exploit campaigns targeting thousands of WordPress sites regardless of their size or popularity. Exploitation requires only Subscriber-level authentication, lowering the barrier for abuse (Patchstack).

1. Reconnaissance: Identify WordPress sites running the "Email marketing for WordPress by GetResponse Official" plugin version 1.5.3 or earlier using tools like WPScan or Shodan.
2. Obtain low-privilege access: Register or obtain a Subscriber-level account on the target WordPress site (e.g., via open user registration).
3. Authenticate: Log in to the WordPress site with the Subscriber account to obtain a valid session cookie or nonce.
4. Access sensitive data: Send authenticated HTTP requests to the plugin's endpoints or pages that expose embedded sensitive data (e.g., API keys or configuration values) without proper access control checks.
5. Leverage exposed credentials: Use any retrieved API keys or credentials to access the site owner's GetResponse account or pivot to further attacks against connected systems (Patchstack).

• Logs: WordPress access logs showing authenticated Subscriber-level users making unusual requests to GetResponse plugin admin pages or REST API endpoints not typically accessed by low-privilege users.
• Logs: Repeated access to plugin-specific PHP files or admin-ajax endpoints by non-administrator accounts.
• Network: Outbound connections from the WordPress server to GetResponse APIs using credentials not initiated by an administrator, potentially indicating credential abuse after exfiltration.
• File System: No file-system artifacts are expected for this read-only data exposure vulnerability.

The vulnerability is patched in version 1.5.4 of the "Email marketing for WordPress by GetResponse Official" plugin; all site owners should update immediately (Patchstack). Patchstack has also issued a virtual patching/mitigation rule for its users to block exploitation attempts until the plugin is updated. If an immediate update is not possible, site administrators should disable open user registration to prevent untrusted users from obtaining Subscriber-level accounts, and consider rotating any GetResponse API keys that may have been exposed.