CVE-2025-67547: 
WordPress vulnerability analysis and mitigation

CVE-2025-67547 is a Missing Authorization (Broken Access Control) vulnerability in the Konte WordPress theme developed by uixthemes. It allows unauthenticated remote attackers to exploit incorrectly configured access control security levels, affecting Konte versions up to and including 2.4.6. The vulnerability was reported on November 20, 2025, and published on January 29, 2026, with a patched version (2.4.7) subsequently released. It carries a CVSS v3.1 base score of 6.5 (Medium) (Patchstack, Feedly).

The root cause is classified as CWE-862 (Missing Authorization), meaning the theme fails to perform adequate authorization checks before executing certain privileged actions. An unauthenticated attacker can send crafted network requests to trigger functionality that should be restricted to higher-privileged users, exploiting the absence of nonce token or capability checks. No user interaction is required, and the attack complexity is low, making it straightforward to exploit over the network (Patchstack, Feedly).

Successful exploitation can result in unauthorized modification of site content or settings (low integrity impact) and potential disruption of availability (low availability impact), with no direct confidentiality impact. Because no authentication is required, the vulnerability is suitable for mass-exploit campaigns targeting large numbers of WordPress sites indiscriminately. Patchstack notes that vulnerabilities of this class are commonly used in automated, large-scale attacks against WordPress installations regardless of site size or traffic (Patchstack).

No public proof-of-concept exploit code has been identified at this time, and there is no confirmed evidence of active in-the-wild exploitation. The EPSS score is approximately 0.017% (0.000170), indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack classifies it as medium priority and warns it is expected to be used in mass-exploit campaigns targeting WordPress themes (Patchstack, Feedly).

The vendor (uixthemes) has released Konte version 2.4.7, which patches this vulnerability. All users running Konte version 2.4.6 or earlier should update to 2.4.7 or later immediately. Patchstack has also issued a virtual patching/mitigation rule for subscribers that blocks both legitimate and illegitimate requests to the vulnerable functionality until the theme is updated (Patchstack).

Patchstack, which credited researcher Phat RiO for discovering and reporting the vulnerability on November 20, 2025, published the advisory on January 29, 2026, and issued a virtual mitigation rule for its users. The Wordfence Intelligence weekly WordPress vulnerability report for the period of January 26–February 1, 2026 also referenced this CVE (Patchstack, Wordfence Blog).