CVE-2025-67582: 
WordPress vulnerability analysis and mitigation

CVE-2025-67582 is a Missing Authorization vulnerability in the Wbcom Designs "lock-my-bp" WordPress plugin that allows unauthenticated attackers to exploit incorrectly configured access control security levels. It affects all versions of the plugin through 2.1.1. The vulnerability was published on December 9, 2025, and was assigned by Patchstack. It carries a CVSS v3.1 base score of 5.3 (Medium) (Feedly, ENISA EUVD).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether a requesting user has the necessary permissions before performing sensitive operations. The attack vector is network-based, requires no privileges, no user interaction, and has low attack complexity, making it trivially exploitable by unauthenticated remote attackers. The vulnerability specifically relates to exploiting incorrectly configured access control security levels within the BuddyPress community locking functionality provided by the plugin (Feedly, Patchstack).

Successful exploitation results in a low-level confidentiality impact, allowing unauthenticated attackers to access content or functionality that should be restricted by the plugin's access control mechanisms. There is no direct integrity or availability impact based on the CVSS assessment. The scope is limited to the affected WordPress installation, but unauthorized access to protected BuddyPress community content could expose sensitive user-generated data (Feedly).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.04%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Feedly).

Users should update the Wbcom Designs "lock-my-bp" WordPress plugin to a version beyond 2.1.1 if a patched release is available from the vendor. As an interim measure, site administrators can consider deactivating the plugin until a fix is confirmed, or restricting access to the WordPress site via network-level controls. Monitor the official WordPress plugin repository and the Wbcom Designs vendor page for patch announcements (Patchstack).