What is the CVSS score of CVE-2025-63067?

CVE-2025-63067 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Wordpress Plugin CVE-2025-63067

MEDIUM

Missing Authorization (CWE-862)

2025-12-09 audit@patchstack.com

WordPress Authentication Bypass Wordpress Plugin

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 01, 2026 - 15:22 vuln.today

CVE Published

Dec 09, 2025 - 16:18 nvd

MEDIUM 4.3

DescriptionCVE.org

Missing Authorization vulnerability in p-themes Porto Theme - Functionality porto-functionality allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Porto Theme - Functionality: from n/a through < 3.7.3.

AnalysisAI

Porto Theme - Functionality plugin for WordPress (versions before 3.7.3) allows authenticated users to access sensitive information through broken access control, enabling privilege escalation or information disclosure without proper authorization checks. While the vulnerability requires valid WordPress credentials and has low CVSS severity (4.3), the confirmed patch availability and authentication requirement reduce immediate risk. No public exploit code or active exploitation has been identified at the time of analysis.

Technical ContextAI

This is a missing authorization vulnerability (CWE-862: Improper Access Control) in the Porto Theme - Functionality WordPress plugin. The vulnerability stems from inadequate access control checks on protected functionality, allowing authenticated users with lower privilege levels to perform actions or access data normally restricted to higher-privilege roles. WordPress plugins implement role-based access control through the capabilities system; this plugin fails to properly verify the current user's capabilities before executing sensitive operations. The underlying issue is a logic flaw in authorization enforcement rather than a cryptographic or authentication weakness-valid sessions can bypass intended permission boundaries.

Affected ProductsAI

Porto Theme - Functionality plugin for WordPress is affected in all versions from the earliest tracked version through version 3.7.2, inclusive. The plugin is identified by CPE reference to the Patchstack WordPress plugin database entry. Vendor advisory and patch information is available at https://patchstack.com/database/Wordpress/Plugin/porto-functionality/vulnerability/wordpress-porto-theme-functionality-plugin-3-6-2-broken-access-control-vulnerability?_s_id=cve.

RemediationAI

Vendor-released patch: Update Porto Theme - Functionality plugin to version 3.7.3 or later. Site administrators should navigate to the WordPress Plugins dashboard, locate Porto Theme - Functionality, and apply the available update immediately. No workarounds are documented; patching is the primary remediation path. For sites unable to update immediately, restrict plugin access to trusted administrators only and monitor audit logs for unauthorized access attempts. Detailed patch and advisory information is available at the Patchstack vulnerability database URL provided in the references.