CVE-2025-67931: 
WordPress vulnerability analysis and mitigation

CVE-2025-67931 is a Sensitive Data Exposure vulnerability (CWE-201: Insertion of Sensitive Information Into Sent Data) in the AITpro BulletProof Security WordPress plugin. It affects all versions up to and including 6.9, and was reported by researcher Nabil Irawan on October 22, 2025, with public disclosure on January 6–8, 2026. The vulnerability allows unauthenticated remote attackers to retrieve embedded sensitive data that should not be accessible to regular users. It carries a CVSS v3.1 base score of 7.5 (High) (Patchstack, NVD).

The vulnerability is classified under CWE-201 (Insertion of Sensitive Information Into Sent Data), meaning the plugin inadvertently includes sensitive data in responses or transmitted data that can be intercepted or retrieved by unauthenticated parties. The attack vector is network-based, requires no privileges, no user interaction, and has low attack complexity — making it trivially exploitable remotely. Patchstack notes that due to the specific nature of this vulnerability, no virtual patch can be assigned, underscoring that a code-level fix is the only remediation path (Patchstack).

Successful exploitation allows an unauthenticated attacker to view sensitive information that is normally restricted to privileged users, with a high confidentiality impact and no integrity or availability impact. The exposed data could include configuration details, credentials, or other security-relevant information embedded in plugin responses, which could then be leveraged to facilitate further attacks against the WordPress site or its underlying infrastructure. Given that BulletProof Security is a security plugin, exposure of its internal data may directly undermine the site's defensive posture (Patchstack).

No public proof-of-concept exploit code or active in-the-wild exploitation has been confirmed at this time. The EPSS score is approximately 0.018% (0.000180), indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack rates it as high priority and warns that vulnerabilities of this type are commonly used in mass-exploit campaigns targeting thousands of WordPress sites regardless of their size or popularity (Patchstack, NVD).

The vendor (AITpro) has released version 7.0 of the BulletProof Security plugin, which resolves this vulnerability. Site administrators should update to version 7.0 or later immediately. No virtual patch is available from Patchstack for this specific vulnerability, so updating the plugin is the only effective remediation. Patchstack users can enable auto-update for vulnerable plugins to streamline the process (Patchstack).

The vulnerability was reported by security researcher Nabil Irawan and disclosed through Patchstack's coordinated disclosure process. Patchstack classified it as high priority and flagged it as the type of vulnerability commonly leveraged in mass WordPress exploit campaigns. No significant broader media coverage or notable researcher commentary beyond the Patchstack advisory has been identified (Patchstack).