CVE-2025-67621: 
WordPress vulnerability analysis and mitigation

CVE-2025-67621 is a sensitive data exposure vulnerability in the Eight Day Week Print Workflow WordPress plugin developed by 10up. Classified under CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), it allows unauthenticated remote attackers to retrieve embedded sensitive data from affected installations. All versions up to and including 1.2.5 are affected. The vulnerability was published on December 24, 2025, and assigned by Patchstack. It carries a CVSS v3.1 base score of 7.5 (High) (Feedly, Patchstack).

The vulnerability is rooted in improper handling of sensitive system information within the plugin, allowing it to be exposed to unauthorized parties (CWE-497). The attack vector is network-based, requires no authentication, no user interaction, and low attack complexity, making it trivially exploitable by any remote attacker. The exploitation technique maps to CAPEC-170 (Web Application Fingerprinting / Retrieve Embedded Sensitive Data), suggesting that sensitive data — potentially including configuration details, credentials, or internal system information — may be accessible through the plugin's exposed endpoints or responses (Feedly).

Successful exploitation results in a high confidentiality impact with no effect on integrity or availability. An unauthenticated attacker can retrieve sensitive system information embedded within the plugin's output, which could include internal configuration data, API keys, or other privileged information embedded in WordPress responses. This information could facilitate further attacks against the WordPress installation or underlying infrastructure (Feedly).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-67621 as of the available data. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.031%, indicating a very low probability of exploitation in the near term (Feedly). No threat actor attribution has been identified.

Users should update the Eight Day Week Print Workflow plugin to a version beyond 1.2.5 as soon as a patched release is made available by 10up. In the interim, site administrators should consider deactivating the plugin if it is not actively required, and review web server access logs for unusual requests targeting plugin-specific endpoints. Restricting access to the WordPress installation via IP allowlisting or a web application firewall (WAF) can reduce exposure (Patchstack).