CVE-2025-67546: 
WordPress vulnerability analysis and mitigation

CVE-2025-67546 is a Sensitive Data Exposure vulnerability (CWE-497) in the weDevs WP ERP WordPress plugin that allows authenticated attackers with low privileges to retrieve embedded sensitive system information. It affects WP ERP versions up to and including 1.16.6, with version 1.16.7 containing the fix. The vulnerability was reported on October 27, 2025, and published by Patchstack on November 26, 2025, with the CVE formally assigned on December 18, 2025. It carries a CVSS v3.1 base score of 6.5 (Medium) (Patchstack).

The root cause is classified as CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), meaning the plugin exposes internal system data in a context accessible to unauthorized actors. Exploitation requires only a low-privilege authenticated account (Subscriber level), and the attack is conducted over the network with low complexity and no user interaction required. The vulnerability maps to OWASP Top 10 category A3: Sensitive Data Exposure and is associated with the CAPEC-170 (Web Application Fingerprinting) attack pattern, suggesting the exposed data could aid further reconnaissance or exploitation (Patchstack).

Successful exploitation allows a low-privileged authenticated attacker to access sensitive system information that should not be available to regular users, resulting in a high confidentiality impact with no effect on integrity or availability. The exposed data could be leveraged to facilitate further attacks against the WordPress installation or underlying infrastructure. Patchstack notes that vulnerabilities of this type are commonly used in mass-exploit campaigns targeting thousands of WordPress sites regardless of their size or traffic (Patchstack).

No public proof-of-concept exploit code or confirmed in-the-wild exploitation has been reported at this time. The EPSS score is very low at approximately 0.018%, indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack assesses that vulnerabilities of this class are expected to be exploited and are frequently used in mass-exploit campaigns targeting WordPress plugins (Patchstack).

The vendor has released WP ERP version 1.16.7, which patches this vulnerability, and updating to this version or later is the recommended remediation. Site administrators who cannot immediately update should contact their hosting provider or web developer for assistance. Patchstack users benefit from a virtual patching/mitigation rule that blocks exploitation attempts until the plugin is updated, and auto-update for vulnerable plugins can be enabled through the Patchstack platform (Patchstack).

The vulnerability was discovered by security researcher 'daroo' and disclosed through Patchstack's coordinated disclosure process. Wordfence referenced the vulnerability in their weekly WordPress vulnerability report for the period of November 24–30, 2025. No significant broader media coverage or notable researcher commentary beyond the initial disclosure has been identified (Patchstack).