CVE-2025-67571: 
WordPress vulnerability analysis and mitigation

CVE-2025-67571 is a Missing Authorization (Broken Access Control) vulnerability in the WPFunnels WordPress plugin that allows unauthenticated attackers to exploit incorrectly configured access control security levels. It affects WPFunnels versions up to and including 3.6.2. The vulnerability was published on December 9, 2025, and was assigned by Patchstack. It carries a CVSS v3.1 base score of 5.3 (Medium) (Feedly, Patchstack).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether a requesting user has the necessary permissions before executing certain actions. The attack vector is network-based, requires no authentication, no user interaction, and low attack complexity, making it trivially exploitable by any remote attacker. The vulnerability stems from incorrectly configured access control security levels within the WPFunnels plugin, allowing unauthorized parties to perform restricted operations (Feedly).

Successful exploitation results in a low integrity impact with no confidentiality or availability impact, meaning attackers can make unauthorized modifications to data or plugin behavior without gaining read access to sensitive information or disrupting service. The scope is limited to the affected WordPress installation running the vulnerable WPFunnels plugin. While the impact is moderate, unauthorized manipulation of funnel configurations or related plugin data could affect marketing workflows and site integrity (Feedly).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-67571. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Feedly).

Users should update the WPFunnels WordPress plugin to a version beyond 3.6.2 that addresses this access control flaw. Check the official WordPress plugin repository or the WPFunnels vendor site for the latest patched release. As a temporary workaround, site administrators can consider disabling the plugin until a patch is applied, or restrict access to the WordPress admin and REST API endpoints via firewall rules or web application firewall (WAF) policies (Patchstack).