CVE-2025-67568: 
WordPress vulnerability analysis and mitigation

CVE-2025-67568 is a Missing Authorization vulnerability in the Basel WordPress theme developed by xtemos, classified under CWE-862. It allows unauthenticated network-based attackers to exploit incorrectly configured access control security levels. All versions of the Basel theme up to and including 5.9.1 are affected. The vulnerability was published on December 9, 2025, and was reported by Patchstack. It carries a CVSS v3.1 base score of 5.3 (Medium) (Feedly, EUVD).

The root cause is a Missing Authorization flaw (CWE-862) in the Basel WordPress theme, meaning certain actions or endpoints within the theme fail to verify whether the requesting user has the appropriate permissions before executing. This allows an unauthenticated remote attacker to interact with functionality that should be restricted, effectively exploiting incorrectly configured access control security levels. No user interaction or elevated privileges are required, and the attack vector is entirely network-based with low complexity (Feedly, Patchstack).

Successful exploitation of this vulnerability results in a limited integrity impact — an unauthenticated attacker can perform unauthorized actions on the affected WordPress site, such as modifying data or triggering restricted theme functionality. Confidentiality and availability are not directly impacted according to the CVSS assessment. The scope is limited to the affected system, but unauthorized write access could potentially be leveraged as a stepping stone for further compromise of the WordPress installation (Feedly).

There is no public evidence of active in-the-wild exploitation or weaponized exploit code for CVE-2025-67568 at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.017%, indicating a very low probability of exploitation in the near term (Feedly).

Users of the Basel WordPress theme should update to a version beyond 5.9.1 as soon as a patched release is made available by xtemos. In the interim, site administrators should consider restricting access to the WordPress admin area via IP allowlisting, disabling the theme if it is not actively required, and monitoring for unauthorized changes to site content or settings. Regularly auditing WordPress theme and plugin versions using security tools such as Wordfence or Patchstack is also recommended (Patchstack).

The vulnerability was reported and disclosed by Patchstack, which operates a vulnerability disclosure program (VDP) for WordPress themes and plugins. Wordfence referenced the vulnerability in its weekly WordPress vulnerability report for the period of November 17–23, 2025. No significant broader media coverage or notable researcher commentary beyond standard disclosure channels has been identified (Wordfence).