CVE-2025-64378: 
WordPress vulnerability analysis and mitigation

CVE-2025-64378 is a Missing Authorization (Broken Access Control) vulnerability in the CridioStudio ListingPro WordPress theme. It allows unauthenticated remote attackers to exploit incorrectly configured access control security levels, potentially modifying data without proper authorization. The vulnerability affects ListingPro versions prior to 2.9.10 and was disclosed on December 18, 2025, by Patchstack. It carries a CVSS v3.1 base score of 7.5 (High) (Feedly, Patchstack).

The root cause is classified as CWE-862 (Missing Authorization), meaning the ListingPro theme fails to properly verify whether a requesting user has the necessary permissions before executing sensitive actions. The attack vector is network-based, requires no authentication, no user interaction, and low attack complexity, making it trivially exploitable by any remote attacker. The vulnerability stems from incorrectly configured access control security levels within the theme's functionality, allowing unauthorized actors to perform privileged operations (Feedly, Patchstack).

Successful exploitation results in a high integrity impact with no confidentiality or availability impact, meaning attackers can modify or manipulate data within the affected WordPress site without authorization. This could allow unauthorized changes to listings, settings, or other theme-managed content on sites running the ListingPro theme. The scope is unchanged, limiting the direct impact to the vulnerable component, but unauthorized data modification could undermine the trustworthiness and reliability of affected directory/listing websites (Feedly).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported as of the available data. The EPSS score is approximately 0.017% (0.000170), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The vulnerability was assigned and disclosed by Patchstack (Feedly).

Users should update the ListingPro WordPress theme to version 2.9.10 or later, which addresses the missing authorization checks. No specific configuration-based workarounds have been publicly documented. Site administrators should audit recent activity logs for unauthorized modifications to listings or theme settings and apply the patch as a priority given the unauthenticated nature of the vulnerability (Patchstack).