CVE-2025-64631: 
WordPress vulnerability analysis and mitigation

CVE-2025-64631 is a Missing Authorization (Broken Access Control) vulnerability in the WCFM Marketplace WordPress plugin developed by WC Lovers. It allows authenticated attackers with high privileges (Store Vendor level) to exploit incorrectly configured access control security levels. The vulnerability affects WCFM Marketplace versions up to and including 3.7.1, as updated by Patchstack in April 2026 (originally disclosed as affecting up to 3.6.15). It was reported by researcher benzdeus, disclosed on December 15–16, 2025, and carries a CVSS v3.1 base score of 4.9 (Medium) (Patchstack, NVD).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether a requesting user has the appropriate permissions before executing certain privileged actions. An authenticated attacker with Store Vendor-level access can exploit this by sending crafted requests to functions that lack proper authorization or nonce token checks, effectively performing actions reserved for higher-privileged roles. No user interaction is required, and the attack is conducted over the network with low complexity (Patchstack, NVD).

Successful exploitation primarily impacts availability (High), with no direct confidentiality or integrity impact per the CVSS scoring. A Store Vendor-level attacker could trigger unauthorized actions within the marketplace plugin, potentially disrupting marketplace operations or causing denial-of-service conditions for the affected WordPress site. The scope is limited to the affected system, and there is no evidence of lateral movement or sensitive data exposure risk based on current information (Patchstack).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for CVE-2025-64631. The EPSS score is very low at approximately 0.017%, indicating a low probability of exploitation in the near term. The vulnerability requires high privileges (Store Vendor role), which further limits the attacker pool. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and Patchstack classifies it as low priority with unlikely exploitation impact (Patchstack, NVD).

As of the time of disclosure, no official patch was available for WCFM Marketplace, with the vulnerable version noted as 3.7.3 and below per Patchstack's Active VDP listing. Site administrators should monitor the WC Lovers plugin repository for an updated release and apply it immediately upon availability. In the interim, consider restricting Store Vendor account creation and access, or using a WordPress security plugin such as Patchstack to virtually patch the vulnerability. If the plugin is not essential, temporarily deactivating it reduces exposure (Patchstack).

The vulnerability was reported through Patchstack's Active Vulnerability Disclosure Program (VDP) by researcher benzdeus on November 16, 2025, and publicly disclosed on December 15, 2025. Patchstack classified it as low priority with unlikely exploitation impact, and no significant media coverage or notable community discussion has been identified beyond the initial advisory (Patchstack).