CVE-2025-67548: 
WordPress vulnerability analysis and mitigation

CVE-2025-67548 is a Missing Authorization (Broken Access Control) vulnerability in the WP Delicious WordPress plugin (slug: delicious-recipes) that allows authenticated low-privileged users to exploit incorrectly configured access control security levels. It affects all versions up to and including 1.9.1, with version 1.9.2 containing the fix. The vulnerability was reported on October 10, 2025, and published on November 9, 2025 by Patchstack. It carries a CVSS v3.1 base score of 6.5 (Medium) (Patchstack).

The root cause is classified as CWE-862 (Missing Authorization), meaning one or more plugin functions lack proper authorization, authentication, or nonce token checks before executing privileged actions. This allows a low-privileged authenticated user (at the Contributor or Developer role level) to invoke functionality that should be restricted to higher-privileged roles. The attack vector is network-based, requires low privileges and user interaction, and has low attack complexity. No public proof-of-concept code has been identified at this time (Patchstack).

Successful exploitation could allow a low-privileged authenticated user (e.g., a Contributor) to perform actions reserved for higher-privileged roles within the WP Delicious plugin, potentially affecting confidentiality, integrity, and availability at a low level each. The vulnerability has a changed scope, meaning its impact can extend beyond the plugin itself to other components of the WordPress installation. While rated as low priority by Patchstack with no impactful threat currently identified, broken access control vulnerabilities of this class are commonly leveraged in mass-exploit campaigns targeting large numbers of WordPress sites (Patchstack).

No active in-the-wild exploitation has been reported, and no public exploit code is currently known. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack classifies this as low priority with unlikely exploitation, though it notes that broken access control vulnerabilities are frequently used in mass-exploit campaigns against WordPress sites (Patchstack).

The vendor has released version 1.9.2 of the WP Delicious plugin, which patches this vulnerability. Site administrators should update the plugin to version 1.9.2 or later immediately via the WordPress admin dashboard or by downloading the updated plugin from the WordPress plugin repository. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard. If an immediate update is not possible, restricting Contributor and Developer role access or temporarily deactivating the plugin is advisable (Patchstack).

The vulnerability was discovered and disclosed by security researcher theviper17 through Patchstack's coordinated disclosure process. Patchstack classifies it as low priority with no impactful threat currently observed. No significant broader media coverage or notable community commentary has been identified beyond the Patchstack advisory (Patchstack).