What is the CVSS score of CVE-2025-62961?

CVE-2025-62961 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.1%.

Wordpress Theme CVE-2025-62961

MEDIUM

Missing Authorization (CWE-862)

2025-12-18 audit@patchstack.com

WordPress Authentication Bypass Wordpress Theme

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

CVSS changed

Apr 23, 2026 - 15:43 NVD

5.4 (MEDIUM)

Analysis Generated

Apr 01, 2026 - 17:44 vuln.today

CVE Published

Dec 18, 2025 - 17:15 nvd

N/A

DescriptionCVE.org

Missing Authorization vulnerability in sparklewpthemes Sparkle FSE sparkle-fse allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sparkle FSE: from n/a through <= 1.0.9.

AnalysisAI

Missing authorization controls in Sparkle FSE WordPress theme versions 1.0.9 and earlier allow unauthenticated attackers to bypass access control restrictions and perform unauthorized actions through exploitable endpoint misconfigurations. This authentication bypass vulnerability, reported by Patchstack security researchers, affects all instances of the Sparkle FSE theme up to version 1.0.9 with low exploit probability (EPSS 0.05%) but represents a direct authorization failure (CWE-862) that could enable unauthorized data access or modification depending on endpoint exposure.

Technical ContextAI

The vulnerability stems from broken access control (CWE-862: Missing Authorization) in the Sparkle FSE WordPress theme, a full-site editing (FSE) template system for WordPress. The theme fails to properly validate user permissions before granting access to protected functionality, creating a class of misconfigurations where security levels are either not enforced or incorrectly configured. This is distinct from authentication bypass in that users may not need to prove identity at all; rather, authorization checks that should restrict actions to specific user roles or capabilities are absent or improperly implemented. WordPress themes implementing custom endpoints or REST API handlers must validate both user authentication and authorization permissions before exposing sensitive operations.

Affected ProductsAI

Sparkle FSE WordPress theme (sparkle-fse), versions 1.0.9 and earlier, is affected. CPE data is not independently available from the provided sources, but the Patchstack advisory identifies this as a theme vulnerability affecting WordPress installations using Sparkle FSE. Users can verify their installed version in the WordPress theme dashboard or through WordPress.org theme directory.

RemediationAI

Update Sparkle FSE theme to a patched version released after 1.0.9. Visit the Patchstack vulnerability database entry (https://patchstack.com/database/Wordpress/Theme/sparkle-fse/vulnerability/wordpress-sparkle-fse-theme-1-0-9-broken-access-control-vulnerability) or the official WordPress theme repository for Sparkle FSE to download the latest version with authorization controls properly implemented. If automatic updates are not enabled in WordPress, manually update the theme through Appearance → Themes → Update in the WordPress admin dashboard. As an interim mitigation, site administrators may restrict access to theme customization and REST API endpoints through Web Application Firewall (WAF) rules or authentication plugins until the update is available, though patching is the definitive remediation.