CVE-2025-67578: 
WordPress vulnerability analysis and mitigation

CVE-2025-67578 is a Missing Authorization vulnerability in the WP Email Capture WordPress plugin developed by Rhys Wynne. It allows unauthenticated remote attackers to exploit incorrectly configured access control security levels. The vulnerability affects WP Email Capture versions up to and including 3.12.4. It was published on December 9, 2025, and carries a CVSS v3.1 base score of 5.3 (Medium) (Feedly, Patchstack).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether a requesting user has the necessary permissions before executing certain actions. This allows network-based attackers with no authentication or special privileges to access restricted functionality or data. The attack vector is network-accessible, requires low complexity, and no user interaction, making it straightforward to exploit against any exposed WordPress installation running the affected plugin (Feedly).

Successful exploitation results in unauthorized read access to limited information (low confidentiality impact), with no direct impact on integrity or availability. An attacker could access data or functionality that should be restricted to authorized users, such as captured email addresses or plugin configuration details. While the impact is constrained in scope, exposure of email subscriber data could facilitate phishing campaigns or spam operations (Feedly).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been identified for this vulnerability. The EPSS score is approximately 0.04%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Feedly).

Users should update the WP Email Capture plugin to a version beyond 3.12.4 if a patched release is available from the plugin author (Rhys Wynne). In the interim, site administrators should consider deactivating the plugin until a fix is confirmed, or restricting access to the WordPress site using firewall rules or IP allowlisting. Monitoring WordPress access logs for unexpected requests to plugin-specific endpoints is also advisable (Patchstack).