CVE-2025-67573: 
WordPress vulnerability analysis and mitigation

CVE-2025-67573 is a Missing Authorization vulnerability in the ThimPress Sailing WordPress theme that allows unauthenticated attackers to exploit incorrectly configured access control security levels. It affects all versions of the Sailing theme from n/a through versions earlier than 4.4.6. The vulnerability was published on December 9, 2025, and assigned by Patchstack. It carries a CVSS v3.1 base score of 5.3 (Medium) (Feedly, Patchstack).

The root cause is classified as CWE-862 (Missing Authorization), meaning the Sailing theme fails to properly verify whether a requesting user has the necessary permissions before performing certain actions. The vulnerability is network-exploitable with low attack complexity, requires no privileges, and no user interaction, making it accessible to any unauthenticated remote attacker. The specific functionality lacking authorization checks has not been publicly detailed in available sources, but the flaw allows attackers to exploit incorrectly configured access control security levels within the theme (Feedly).

Successful exploitation results in a limited integrity impact — attackers can perform unauthorized actions or modifications that the theme's access controls were intended to prevent, without gaining read access to sensitive data or causing service disruption. Confidentiality and availability are not directly affected according to the CVSS assessment. The scope is limited to the affected WordPress installation running the vulnerable Sailing theme (Feedly).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for CVE-2025-67573. The EPSS score is approximately 0.022%, indicating a very low probability of exploitation in the near term. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been identified (Feedly).

Users of the ThimPress Sailing WordPress theme should update to version 4.4.6 or later, which addresses the missing authorization checks. Site administrators should verify the installed theme version via the WordPress dashboard under Appearance > Themes and apply the update promptly. As a general hardening measure, limiting access to WordPress admin interfaces and monitoring for unexpected content changes can reduce exposure (Feedly, Patchstack).