CVE-2025-67584: 
WordPress vulnerability analysis and mitigation

CVE-2025-67584 is a Missing Authorization vulnerability in the rtCamp GoDAM WordPress plugin that allows unauthenticated attackers to exploit incorrectly configured access control security levels. It affects GoDAM versions from n/a through 1.4.6 (inclusive). The vulnerability was published on December 9, 2025, with Patchstack credited as the assigner. It carries a CVSS v3.1 base score of 5.3 (Medium) (Feedly, Patchstack).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify that a requesting user has the necessary permissions before granting access to certain functionality or data. The attack vector is network-based, requires no authentication, no user interaction, and low attack complexity, making it trivially exploitable by any remote attacker. The vulnerability falls under the broader category of Broken Access Control, where improperly configured access control security levels allow unauthorized access to restricted plugin features or data (Feedly).

Successful exploitation results in a limited confidentiality impact — specifically, unauthorized read access to information that should be restricted to authenticated or privileged users. There is no direct integrity or availability impact based on the CVSS scoring. The scope is limited to the affected WordPress installation, but exposure of sensitive media asset metadata or configuration data managed by GoDAM could facilitate further targeted attacks (Feedly).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-67584 as of the available data. The EPSS score is approximately 0.04%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Feedly).

Users should update the GoDAM WordPress plugin to a version beyond 1.4.6 that addresses this missing authorization check. As an interim measure, site administrators can restrict access to the WordPress installation using network-level controls (e.g., IP allowlisting for the admin panel) or disable the plugin until a patched version is available. Monitor the WordPress plugin repository and the Patchstack advisory page for patch release announcements (Patchstack).