CVE-2025-64273: 
WordPress vulnerability analysis and mitigation

CVE-2025-64273 is a Missing Authorization (Broken Access Control) vulnerability in the "Email marketing for WordPress by GetResponse Official" WordPress plugin. It affects all versions up to and including 1.5.3, allowing unauthenticated or low-privileged users to exploit incorrectly configured access control security levels. The vulnerability was reported by researcher Bao - BlueRock on August 26, 2025, and publicly disclosed by Patchstack on September 25, 2025. It carries a CVSS v3.1 base score of 7.5 (High) per NVD, and 6.5 (Medium) per Patchstack's assessment (Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the plugin fails to perform adequate authorization checks before executing privileged actions. Specifically, a missing authorization, authentication, or nonce token check in one or more plugin functions allows a low-privileged user (as low as Subscriber level) to perform actions that should be restricted to higher-privileged roles. The attack vector is network-based, requires no user interaction, and has low attack complexity, making it straightforward to exploit remotely (Patchstack).

Successful exploitation allows an unprivileged or low-privileged attacker to perform unauthorized administrative actions within the GetResponse plugin, resulting in a high integrity impact with no confidentiality or availability impact per the CVSS scoring. This could include unauthorized modification of email marketing settings, subscriber lists, or plugin configurations on affected WordPress sites. Patchstack notes that vulnerabilities of this class are commonly used in mass-exploit campaigns targeting thousands of WordPress sites regardless of their size or traffic (Patchstack).

No public proof-of-concept exploit code has been identified at this time. The EPSS score is very low at approximately 0.017%, suggesting limited current exploitation probability. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack classifies it as expected to become exploited and notes it is the type used in mass-exploit campaigns against WordPress sites (Patchstack).

The vulnerability is patched in version 1.5.4 of the "Email marketing for WordPress by GetResponse Official" plugin. Site administrators should update to version 1.5.4 or later immediately. Patchstack users benefit from an automatically deployed virtual patch (mitigation rule) that blocks exploitation attempts until the plugin is updated. If an immediate update is not possible, site owners should contact their hosting provider or web developer for assistance (Patchstack).