CVE-2025-67470: 
WordPress vulnerability analysis and mitigation

CVE-2025-67470 is a Sensitive Data Exposure vulnerability in the "Portfolio and Projects" WordPress plugin by Essential Plugin, classified under CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere). It affects all versions of the plugin up to and including 1.5.5, and was reported by researcher Nabil Irawan on November 5, 2025, with public disclosure on December 5, 2025. The vulnerability carries a CVSS v3.1 base score of 4.3 (Medium) (Patchstack, Feedly).

The vulnerability is rooted in improper access controls that allow authenticated users with low privileges (Contributor/Developer level) to retrieve embedded sensitive system data that should not be accessible to regular users (CWE-497). The attack vector is network-based, requires low privileges, low attack complexity, and no user interaction, consistent with CAPEC-170 (Web Application Fingerprinting). The exposed data could be leveraged to identify further weaknesses or attack surfaces within the WordPress installation (Patchstack).

Successful exploitation allows an authenticated attacker with contributor-level access to view sensitive system information not intended for regular users, resulting in a limited confidentiality impact with no integrity or availability impact. While the direct impact is low, the exposed information could be used to facilitate further attacks against the WordPress site or its underlying infrastructure. The vulnerability is classified under OWASP Top 10 A3: Sensitive Data Exposure (Patchstack).

There is no known public proof-of-concept exploit code or evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that while vulnerabilities of this class can be used in mass-exploit campaigns targeting WordPress sites, this specific issue is assessed as low priority and unlikely to be exploited (Patchstack, Feedly).

The vendor has released version 1.5.6 of the Portfolio and Projects plugin, which patches this vulnerability. WordPress site administrators should update the plugin to version 1.5.6 or later immediately. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard. If an immediate update is not possible, site owners should restrict contributor-level access to trusted users only and consult their hosting provider or web developer for assistance (Patchstack).