CVE-2025-64375: 
WordPress vulnerability analysis and mitigation

CVE-2025-64375 is a Missing Authorization vulnerability in the WP Social Ninja WordPress plugin (also known as wp-social-reviews) developed by Mahmudul Hasan Arif. The flaw allows unauthenticated remote attackers to exploit incorrectly configured access control security levels. All versions of the plugin through 3.20.1 are affected. It was published on December 18, 2025, and assigned a CVSS v3.1 base score of 6.5 (Medium) (Feedly, Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether a requesting user has the necessary permissions before executing sensitive operations. Because no authentication or capability check is enforced on the affected endpoint(s), any unauthenticated network-accessible attacker can trigger restricted functionality. The attack requires no user interaction, no special privileges, and low complexity, making it straightforward to exploit over the network (Feedly).

Successful exploitation results in limited but meaningful confidentiality and integrity impacts — attackers can read low-sensitivity data and make unauthorized modifications within the plugin's scope, though availability is not affected. Because the plugin manages social media reviews and feeds on WordPress sites, unauthorized access could allow an attacker to tamper with displayed social proof content or access connected social platform configuration data. The scope is unchanged, meaning impact is confined to the vulnerable component rather than the broader WordPress installation (Feedly).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported for CVE-2025-64375 as of the available data. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Feedly).

Users should update the WP Social Ninja plugin to a version beyond 3.20.1, which is the last confirmed vulnerable release. Check the WordPress plugin repository or the vendor's official page for the patched release. As an interim measure, site administrators can deactivate the plugin until a patch is applied, or restrict access to the WordPress site's REST API or admin-facing endpoints via firewall rules or a web application firewall (WAF) (Feedly, Patchstack).

The vulnerability was reported and coordinated through Patchstack's vulnerability disclosure program. A Bluesky post referencing the CVE was noted in mid-2026, suggesting minor community awareness. No significant vendor statements, major media coverage, or notable researcher commentary beyond the initial disclosure have been identified (Feedly).