CVE-2025-64384: 
WordPress vulnerability analysis and mitigation

CVE-2025-64384 is a Missing Authorization vulnerability in the JetFormBuilder WordPress plugin developed by Crocoblock (jetmonsters). It allows authenticated attackers with low-level privileges to exploit incorrectly configured access control security levels, classified under CWE-862. The vulnerability affects JetFormBuilder versions from n/a through 3.5.3. It was published on November 13, 2025, and carries a CVSS v3.1 base score of 6.3 (Medium) (Feedly, ENISA EUVD).

The root cause is a Missing Authorization flaw (CWE-862), meaning the plugin fails to properly verify whether a requesting user has the appropriate permissions before executing certain actions. This allows a low-privileged authenticated user to interact with functionality or data that should be restricted to higher-privilege roles. The attack vector is network-based, requires low privileges, no user interaction, and has low attack complexity. The vulnerability was reported via Patchstack's vulnerability disclosure program (Patchstack, ENISA EUVD).

Successful exploitation results in limited but meaningful impacts across confidentiality, integrity, and availability — each rated Low in the CVSS scoring. An authenticated attacker with minimal privileges could access restricted form data, modify form configurations or submissions, or disrupt plugin functionality beyond their intended authorization scope. The impact is scoped to the affected WordPress installation and does not inherently enable lateral movement or full system compromise, but could expose sensitive user-submitted form data depending on site configuration (Feedly).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported for CVE-2025-64384 as of the available data. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Feedly, Wordfence).

Users should update the JetFormBuilder plugin to a version beyond 3.5.3, which is the last confirmed vulnerable release. The fix was assigned and disclosed by Patchstack; site administrators should check the official WordPress plugin repository or the Crocoblock/JetFormBuilder changelog for the patched release. As a general workaround, restricting plugin access to trusted roles only and auditing user permissions on WordPress installations can reduce exposure until an update is applied (Patchstack, ENISA EUVD).

Wordfence included CVE-2025-64384 in its weekly WordPress vulnerability report for the period of November 24–30, 2025, indicating routine tracking of the issue within the WordPress security community (Wordfence). No significant vendor statements, researcher commentary, or broader media coverage have been identified beyond standard vulnerability database entries.