What is the CVSS score of CVE-2025-62083?

CVE-2025-62083 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2025-62083

MEDIUM

Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497)

2025-12-31 audit@patchstack.com

WordPress Information Disclosure

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

CVSS changed

Apr 23, 2026 - 15:43 NVD

4.3 (MEDIUM)

Analysis Generated

Apr 01, 2026 - 17:44 vuln.today

CVE Published

Dec 31, 2025 - 17:15 nvd

N/A

DescriptionCVE.org

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WP Messiah BoomDevs WordPress Coming Soon coming-soon-by-boomdevs allows Retrieve Embedded Sensitive Data.This issue affects BoomDevs WordPress Coming Soon: from n/a through <= 1.0.4.

AnalysisAI

WP Messiah BoomDevs WordPress Coming Soon plugin through version 1.0.4 exposes sensitive system information to unauthorized access, allowing attackers to retrieve embedded sensitive data without authentication. The vulnerability stems from improper access controls on sensitive data endpoints, classified as CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere). With an EPSS score of 0.01% (2nd percentile), exploitation likelihood is minimal despite the information disclosure nature of the defect.

Technical ContextAI

CWE-497 describes a condition where sensitive system information is exposed to an unauthorized control sphere-typically due to missing or inadequate access restrictions on data that should be protected. In WordPress plugins, this commonly manifests when sensitive configuration, user metadata, or system details are returned via REST API endpoints, AJAX handlers, or publicly accessible functions without proper authentication or authorization checks. The BoomDevs Coming Soon plugin, designed to present a landing page before a WordPress site launches, likely exposes internal site configuration or metadata through an unprotected code path. The plugin affects versions up to and including 1.0.4 according to CVE assignment data.

Affected ProductsAI

WP Messiah BoomDevs WordPress Coming Soon (plugin slug: coming-soon-by-boomdevs) versions from initial release through 1.0.4 are affected. This is a WordPress plugin distributed via the WordPress.org plugin repository and third-party sources. Administrators using this plugin on any version at or below 1.0.4 should apply updates.

RemediationAI

Update the BoomDevs WordPress Coming Soon plugin to a version newer than 1.0.4 immediately via the WordPress admin dashboard (Plugins > Installed Plugins > coming-soon-by-boomdevs > Update). If automatic updates are enabled, the patch should be applied automatically. For manual verification, confirm the installed version in wp-content/plugins/coming-soon-by-boomdevs/ or via the WordPress API. Consult the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/coming-soon-by-boomdevs/vulnerability/wordpress-boomdevs-wordpress-coming-soon-plugin-plugin-1-0-4-sensitive-data-exposure-vulnerability for the exact patched version number and additional context.