CVE-2025-67956: 
WordPress vulnerability analysis and mitigation

CVE-2025-67956 is a Missing Authorization (Broken Access Control) vulnerability in the WPEverest User Registration WordPress plugin affecting all versions through 4.4.6. It allows unauthenticated network attackers to exploit incorrectly configured access control security levels, potentially performing unauthorized privileged actions. The vulnerability was reported on November 8, 2025, and publicly disclosed on January 21–22, 2026. It carries a CVSS v3.1 base score of 8.2 (High), as assigned by Patchstack and confirmed by CISA-ADP (Patchstack, NVD).

The root cause is CWE-862 (Missing Authorization) — the plugin fails to perform adequate authorization, authentication, or nonce token checks on one or more functions, allowing unauthenticated users to invoke actions that should be restricted to privileged roles. The attack vector is network-based, requires no authentication, no user interaction, and has low attack complexity, making it trivially exploitable remotely. This class of vulnerability is commonly abused in mass-exploit campaigns targeting WordPress sites at scale (Patchstack).

Successful exploitation allows an unauthenticated attacker to perform unauthorized privileged actions on affected WordPress sites, with a high integrity impact (e.g., unauthorized data modification or manipulation of user registration settings) and low availability impact. Depending on the specific unprotected function, attackers could potentially alter site configurations, manipulate user accounts, or disrupt registration workflows. Confidentiality impact is assessed as none by Patchstack (though CISA-ADP assessed it as high), indicating some uncertainty about the full scope of data exposure (NVD, Patchstack).

No public proof-of-concept exploit code has been observed, and there is no evidence of active in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. However, Patchstack notes that broken access control vulnerabilities of this type are frequently used in mass-exploit campaigns targeting WordPress plugins regardless of site popularity (Patchstack).

The vendor (WPEverest/ThemeGrill) has released version 4.4.7 of the User Registration plugin, which patches this vulnerability. Site administrators should update to version 4.4.7 or later immediately. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard. If an immediate update is not possible, consider temporarily disabling the plugin or consulting your hosting provider for assistance (Patchstack).

Sucuri included this vulnerability in their January 2026 vulnerability patch roundup, highlighting it as part of broader WordPress plugin security coverage. Patchstack, the discovering and assigning CNA, classified it as low priority with unlikely exploitation impact despite the high CVSS score, noting the discrepancy between standardized scoring and real-world WordPress risk context (Sucuri Blog, Patchstack).