CVE-2025-64295: 
WordPress vulnerability analysis and mitigation

CVE-2025-64295 is a Sensitive Data Exposure vulnerability (CWE-201: Insertion of Sensitive Information Into Sent Data) in the All In One SEO Pack WordPress plugin by Syed Balkhi. It allows authenticated attackers with at least Subscriber-level privileges to retrieve embedded sensitive data that should not be accessible to regular users. All versions up to and including 4.8.6.1 are affected; the issue was patched in version 4.8.7. The vulnerability was reported by Abu Hurayra on August 11, 2025, and published by Patchstack on November 26, 2025, with CVE assignment on December 18, 2025. It carries a CVSS v3.1 base score of 6.5 (Medium) (Patchstack).

The vulnerability is classified under CWE-201 (Insertion of Sensitive Information Into Sent Data) and maps to OWASP Top 10 category A1: Broken Access Control. The root cause is that the plugin improperly includes sensitive information in data transmitted to authenticated users, allowing a low-privileged subscriber-level account to retrieve data that should be restricted. The attack vector is network-based, requires low privileges (Subscriber role), no user interaction, and low attack complexity, making it straightforward to exploit once an attacker has any authenticated session on the WordPress site (Patchstack).

Successful exploitation allows an authenticated attacker to access sensitive information that is normally restricted to higher-privileged users or administrators. While there is no direct integrity or availability impact (CVSS: C:H/I:N/A:N), the exposed data could be leveraged to facilitate further attacks against the WordPress site or its users, such as privilege escalation or targeted phishing. The scope is limited to the affected WordPress instance, but given the plugin's wide deployment, the aggregate risk across installations is notable (Patchstack).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-64295. The EPSS score is very low at 0.018%, indicating a minimal probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack classifies this as low priority with no impactful threat currently observed, though it notes that vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress plugins at scale (Patchstack).

The vendor has released a patched version: All In One SEO Pack 4.8.7. Site administrators should update the plugin immediately via the WordPress dashboard or by downloading the latest version from the WordPress plugin repository. No configuration-based workaround is documented; upgrading to 4.8.7 or later is the only recommended remediation. Patchstack users can enable auto-update for vulnerable plugins to automate this process (Patchstack).

Patchstack, which discovered and disclosed the vulnerability through researcher Abu Hurayra, rates the issue as low priority with no impactful threat currently observed. Sucuri included it in their December 2025 vulnerability patch roundup, indicating routine coverage in the WordPress security community. No significant vendor statements beyond the patch release or notable social media discussion have been identified (Patchstack).