CVE-2025-49970

The Hello FSE Blog theme for WordPress, versions 1.0.6 and earlier, contains a missing authorization vulnerability. This broken access control issue arises from the lack of proper capability or nonce token checks in certain functions, enabling unauthenticated users to execute actions that should require higher privileges [1].

An attacker can exploit this vulnerability without any authentication by sending crafted requests to the vulnerable endpoints. The absence of authorization checks means that any visitor to a site running the affected theme can trigger privileged operations, bypassing the intended access control security levels [1].

Successful exploitation allows an attacker to perform unauthorized actions, such as modifying site settings or content, potentially leading to full site compromise. This type of vulnerability is commonly used in mass-exploit campaigns targeting thousands of WordPress sites regardless of their size or popularity [1].

As a mitigation, users should update the Hello FSE Blog theme to version 1.0.7 or later. If immediate updating is not possible, it is recommended to contact the hosting provider or a web developer for assistance [1].