CVE-2025-64274: 
WordPress vulnerability analysis and mitigation

CVE-2025-64274 is a Missing Authorization (Broken Access Control) vulnerability in the WPKoi Templates for Elementor WordPress plugin, affecting all versions up to and including 3.4.4. The flaw allows authenticated attackers with low privileges (Subscriber-level) to perform actions beyond their intended authorization level. It was reported by researcher benzdeus on November 6, 2025, and published by Patchstack on December 6, 2025. The vulnerability carries a CVSS v3.1 base score of 4.3 (Medium) (Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the plugin fails to perform adequate authorization checks — such as capability checks or nonce token validation — before executing privileged actions. This allows a low-privileged authenticated user (e.g., a Subscriber) to invoke functionality intended for higher-privileged roles. The attack vector is network-based, requires low privileges, no user interaction, and low attack complexity, making it straightforward to exploit for any authenticated WordPress user (Patchstack).

Successful exploitation results in a low integrity impact, allowing an authenticated low-privileged attacker to perform unauthorized actions within the WordPress site that should be restricted to higher-privileged users. There is no direct confidentiality or availability impact. While the individual impact is limited, Patchstack notes that vulnerabilities of this class are commonly used in mass-exploit campaigns targeting thousands of WordPress sites simultaneously, regardless of site size or popularity (Patchstack).

The vulnerability is patched in WPKoi Templates for Elementor version 3.4.5. Site administrators should update the plugin to version 3.4.5 or later immediately. If an immediate update is not possible, site owners should contact their hosting provider or web developer for assistance. Patchstack users can enable auto-update for vulnerable plugins to automate remediation (Patchstack).