CVE-2025-67572: 
WordPress vulnerability analysis and mitigation

CVE-2025-67572 is a Missing Authorization vulnerability in the PenciDesign PenNews WordPress theme that allows unauthenticated attackers to exploit incorrectly configured access control security levels. It affects PenNews versions from n/a through versions earlier than 6.7.4. The vulnerability was published on December 9, 2025, and was assigned by Patchstack. It carries a CVSS v3.1 base score of 5.3 (Medium) (Feedly, Patchstack).

The root cause is classified as CWE-862 (Missing Authorization), meaning the theme fails to properly verify whether a requesting user has the necessary permissions before performing certain actions. The attack vector is network-based, requires no authentication, no user interaction, and low attack complexity, making it trivially exploitable by any remote attacker. The vulnerability falls under the category of Broken Access Control, where specific theme functionality is accessible without appropriate privilege checks (Feedly).

Successful exploitation results in a low integrity impact with no confidentiality or availability impact, meaning an unauthenticated attacker can perform unauthorized actions or modifications within the scope of the vulnerable theme functionality. The vulnerability does not expose sensitive data or cause service disruption, but could allow attackers to alter content or settings in ways not intended for unauthenticated users. The scope is limited to the affected WordPress installation running the PenNews theme (Feedly).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for CVE-2025-67572. The EPSS score is approximately 0.022%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been identified (Feedly).

Users should update the PenNews WordPress theme to version 6.7.4 or later, which addresses the missing authorization checks. Site administrators should audit their WordPress installations for any unauthorized content changes that may have occurred prior to patching. No specific configuration-based workaround has been publicly documented; upgrading to the patched version is the recommended remediation (Patchstack).