Vireo CVE-2025-62751

The CVSS v3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates this is a network-exploitable vulnerability with low attack complexity requiring only low-privileged authenticated access, no user interaction, and delivering high impact across confidentiality, integrity, and availability. The CVSS base score of 8.8 categorizes this as HIGH severity. However, real-world risk signals present a nuanced picture: the EPSS score of 0.04% (13th percentile) suggests extremely low predicted exploitation probability in the wild, and no public exploit code exists at time of analysis. The vulnerability is not present in CISA's Known Exploited Vulnerabilities catalog, confirming no active exploitation campaigns have been observed. The requirement for authenticated access (PR:L) significantly constrains the attack surface compared to unauthenticated vulnerabilities, as attackers must first obtain valid credentials to a WordPress instance running the vulnerable theme. From an SSVC perspective, exploitation status is 'none', technical impact is 'total' (arbitrary read/write/delete operations possible), and automatability is moderate given the need for authentication context. Priority should be elevated for organizations using Vireo theme in production environments with untrusted authenticated users, but this is not a critical emergency for most environments given the low observed exploitation probability and authentication prerequisite.

An attacker who has obtained low-privilege credentials to a WordPress site running Vireo theme 1.0.24-for example, by registering a free subscriber account or compromising a contributor account through credential stuffing-authenticates to the WordPress instance and identifies missing authorization checks in theme functionality. Leveraging the CWE-862 flaw, the attacker directly accesses administrative theme configuration endpoints or restricted WordPress functions without proper capability validation. The attacker can then modify theme settings to inject malicious JavaScript, access confidential data stored in custom post types or theme options, escalate their own privileges by manipulating user metadata, or disrupt site availability by corrupting theme configuration. The low attack complexity (AC:L) and lack of user interaction requirement (UI:N) mean exploitation requires only basic knowledge of WordPress theme architecture and standard HTTP requests. No public exploit code exists at time of analysis, but the straightforward nature of authorization bypass vulnerabilities makes manual exploitation feasible for attackers with basic web application security knowledge.