What is the CVSS score of CVE-2025-62947?

CVE-2025-62947 has a CVSS 3.1 base score of 5.0 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Wordpress Plugin are affected by CVE-2025-62947?

The Publitio WordPress plugin (versions 2.2.5 and earlier) contains a high-severity vulnerability that allows unauthenticated attackers to directly access sensitive data without interaction or…

How to fix or mitigate CVE-2025-62947?

Within 24 hours: Identify all WordPress instances using Publitio plugin and document current version. Within 7 days: Disable or remove Publitio plugin on all affected sites until patched; if plugin functionality is critical, isolate affected instances from production networks and implement network-level access controls (WAF rules blocking requests to plugin endpoints). Within 30 days: Monitor Publitio project for patch release (target version >2.2.5); coordinate upgrade testing and deployment once vendor patch becomes available; audit logs for unauthorized access attempts to plugin functionality.

Wordpress Plugin CVE-2025-62947

MEDIUM

Insertion of Sensitive Information Into Sent Data (CWE-201)

2025-10-27 audit@patchstack.com

WordPress Information Disclosure Wordpress Plugin

5.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.0 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Severity Changed

Apr 23, 2026 - 15:43 NVD

HIGH MEDIUM

CVSS changed

Apr 23, 2026 - 15:43 NVD

7.5 (HIGH) 5.0 (MEDIUM)

Analysis Generated

Apr 01, 2026 - 15:22 vuln.today

CVE Published

Oct 27, 2025 - 02:15 nvd

HIGH 7.5

DescriptionCVE.org

Insertion of Sensitive Information Into Sent Data vulnerability in publitio Publitio publitio allows Retrieve Embedded Sensitive Data.This issue affects Publitio: from n/a through <= 2.2.5.

AnalysisAI

Sensitive data exposure in the Publitio WordPress plugin (versions ≤2.2.5) allows unauthenticated remote attackers to retrieve embedded sensitive information through network requests. The vulnerability exposes confidential data with high impact to confidentiality (CVSS C:H), though exploitation probability remains low (EPSS 3rd percentile). No public exploit identified at time of analysis, and exploitation requires no privileges or user interaction (PR:N/UI:N), making it trivially exploitable if targeted.

Technical ContextAI

This vulnerability stems from CWE-201 (Insertion of Sensitive Information Into Sent Data), a weakness where applications inadvertently include confidential data in transmitted responses. The Publitio plugin for WordPress, which provides media management and delivery capabilities, fails to properly sanitize or restrict sensitive information before sending data to clients. The network-accessible attack vector (AV:N) combined with low complexity (AC:L) indicates the vulnerability likely involves API endpoints, configuration files, or response payloads that directly expose sensitive data such as API keys, authentication tokens, internal paths, or user credentials. The affected product is the WordPress Publitio plugin (org.wordpress.plugin.publitio) through version 2.2.5, requiring immediate attention from installations using these versions.

Affected ProductsAI

The vulnerability affects the Publitio WordPress plugin in all versions up to and including version 2.2.5. Publitio provides cloud-based media management and delivery services integrated into WordPress installations, enabling users to upload, transform, and serve media assets. Any WordPress site with the Publitio plugin installed at version 2.2.5 or earlier is vulnerable to sensitive data exposure. According to the Patchstack database reference at https://patchstack.com/database/Wordpress/Plugin/publitio/vulnerability/wordpress-publitio-plugin-2-2-3-sensitive-data-exposure-vulnerability, the vulnerability was identified in the plugin's data handling mechanisms that inadvertently expose sensitive information through network-accessible channels.

RemediationAI

Site administrators should immediately upgrade the Publitio WordPress plugin to a version newer than 2.2.5 if available. Check the official WordPress plugin repository or Publitio's vendor site for the latest patched release addressing CVE-2025-62947. Prior to patching, implement temporary mitigations by restricting network access to WordPress admin endpoints through firewall rules or web application firewall (WAF) policies, and review server logs for suspicious requests attempting to access plugin endpoints. After upgrading, rotate any API keys, credentials, or sensitive tokens that may have been exposed through the vulnerability. Consult the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/publitio/vulnerability/wordpress-publitio-plugin-2-2-3-sensitive-data-exposure-vulnerability for additional vendor guidance and ensure WordPress core and all other plugins are updated to minimize attack surface.