What is the CVSS score of CVE-2025-64199?

CVE-2025-64199 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

wpresidence Theme CVE-2025-64199

MEDIUM

Missing Authorization (CWE-862)

2025-10-29 audit@patchstack.com

WordPress Authentication Bypass Wordpress Theme

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.3 MEDIUM

Unauthenticated network exploitation with no complexity barriers; impact is write-only at low severity with no confidentiality or availability consequences.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 25, 2026 - 12:05 vuln.today

DescriptionCVE.org

Missing Authorization vulnerability in WpEstate wpresidence wpresidence allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects wpresidence: from n/a through <= 5.3.2.

AnalysisAI

Broken access control in the wpresidence WordPress theme (versions through 5.3.2) exposes one or more endpoints that can be reached and triggered by unauthenticated remote attackers, resulting in unauthorized write-level actions against the site. The CVSS vector (PR:N, AV:N, AC:L) confirms no authentication is required, and the 'Authentication Bypass' tag indicates authorization checks are entirely absent rather than merely misconfigured. No public exploit code has been identified and EPSS sits at 0.04% (11th percentile), indicating very low real-world exploitation probability at this time.

Technical ContextAI

CWE-862 (Missing Authorization) indicates the theme registers at least one action hook, AJAX handler, or REST API route without a corresponding capability or nonce check that would restrict it to privileged users. WordPress themes can expose server-side callbacks callable by any visitor; when these lack calls to current_user_can() or equivalent validation, any unauthenticated request can invoke privileged logic. The affected product is the wpresidence WordPress theme by WpEstate, with NVD CPE implicitly scoping impact to WordPress sites running this theme at or below version 5.3.2. The specific endpoint or feature triggering the flaw is not disclosed in available intelligence.

Affected ProductsAI

The wpresidence WordPress theme by WpEstate is affected in all versions from n/a through 5.3.2 inclusive, as reported by Patchstack and confirmed by NVD. No CPE string was formally published in the provided data. The Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/wpresidence/vulnerability/wordpress-wpresidence-theme-5-3-2-broken-access-control-vulnerability provides authoritative scope details.

RemediationAI

Update the wpresidence theme to a version beyond 5.3.2 as soon as the vendor releases a patched build - no specific fix version number is confirmed in the available intelligence, so administrators should monitor the WpEstate changelog and the Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/wpresidence/vulnerability/wordpress-wpresidence-theme-5-3-2-broken-access-control-vulnerability for a confirmed fix version. As a compensating control prior to patching, consider restricting access to WordPress AJAX and REST API endpoints at the web server or WAF layer for unauthenticated users, though this may break legitimate front-end theme functionality and should be tested before deployment. Disabling the theme entirely and switching to a patched alternative is the most effective immediate mitigation if site operations permit it.