CVE-2025-64635: 
WordPress vulnerability analysis and mitigation

CVE-2025-64635 is a Missing Authorization (Broken Access Control) vulnerability in the "Feeds for YouTube" WordPress plugin developed by Syed Balkhi. It affects all versions up to and including 2.4.0, allowing unauthenticated attackers to exploit incorrectly configured access control security levels. The vulnerability was reported on September 30, 2025, by researcher Bao - BlueRock, published by Patchstack on November 6, 2025, and assigned a CVE on December 16, 2025. The Patchstack-assigned CVSS v3.1 base score is 5.3 (Medium) (Patchstack, NVD).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the plugin fails to perform adequate authorization checks before executing certain privileged actions. This allows unauthenticated users to invoke functionality that should be restricted to higher-privileged roles, consistent with OWASP Top 10 category A1: Broken Access Control. No authentication or nonce token validation is enforced on the affected function(s), enabling direct exploitation over the network without any preconditions such as an existing account or user interaction (Patchstack, NVD).

Successful exploitation allows an unauthenticated attacker to perform unauthorized actions within the plugin's scope, primarily affecting the integrity of the WordPress site (e.g., modifying plugin settings or feed configurations). Confidentiality and availability impacts are assessed as none by Patchstack, limiting the practical damage to unauthorized data modification rather than data theft or service disruption. The vulnerability is considered low priority by Patchstack, with no significant lateral movement or data exfiltration risk identified (Patchstack).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress plugins at scale, regardless of site popularity (Patchstack).

The vulnerability is patched in Feeds for YouTube version 2.6.1. Site administrators should update the plugin to version 2.6.1 or later immediately. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard. If an immediate update is not possible, site owners should consult their hosting provider or web developer for assistance (Patchstack).