Genemy WordPress Theme CVE-2025-69137

Exploitation requires the attacker to hold at minimum a WordPress subscriber-level account on the target site, confirmed by PR:L in the CVSS vector - this is the lowest registered user role and can be obtained via self-registration if the site permits it. The site must have the Genemy theme installed and active at version 1.6.6 or earlier. The specific theme function, AJAX action name, or REST route containing the missing authorization check is not disclosed in the available data, so the precise triggering endpoint is not independently confirmed. Exploitation is limited by the authentication prerequisite: sites that disable open user registration substantially reduce exposure, as the attacker must already possess or be able to create a site account. No non-default WordPress configuration beyond having the vulnerable theme active is required.

The CVSS 3.1 score of 6.5 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N reflects a network-exploitable, low-complexity flaw requiring only subscriber-level authentication. The High integrity impact (I:H) indicates the attacker can make significant unauthorized modifications - likely to theme settings, post content, or site options - while the absence of confidentiality (C:N) and availability (A:N) impact limits damage to integrity-based abuse. No EPSS data was included in the provided intelligence; no KEV listing exists and no public exploit or proof-of-concept has been identified, which collectively suggest this has not been observed in active opportunistic exploitation campaigns at time of analysis. The authentication prerequisite (PR:L) materially reduces the realistic attack surface versus unauthenticated flaws: sites that disable open user registration or enforce invitation-only account creation are substantially less exposed. The risk is real but context-dependent - a site with open registration and Genemy ≤1.6.6 active faces meaningful unauthorized modification risk; a closed-membership site faces lower residual risk.

An attacker registers a free subscriber account on a WordPress site running Genemy 1.6.6 or earlier with open user registration enabled. After authenticating, the attacker crafts direct HTTP POST requests to the theme's unprotected AJAX handler or REST endpoint - invoking privileged functionality such as modifying theme options, overwriting page content, or altering site configuration - receiving a successful response because no capability check gates the action. No public exploit code has been identified at time of analysis, but the low complexity and standard WordPress attack surface make manual exploitation straightforward for any attacker familiar with WordPress theme internals.