CVE-2025-58813

Vulnerability

Overview The Consultstreet WordPress theme, versions up to and including 3.0.0, suffers from a missing authorization vulnerability [1]. This flaw stems from incorrectly configured access control security levels, allowing unauthenticated users to bypass intended permission checks.

Exploitation

Details Attackers can exploit this vulnerability without any prior authentication or special network position [1]. The reference indicates that such broken access control issues are commonly used in mass-exploit campaigns, targeting thousands of websites regardless of their size or popularity.

Impact

Successful exploitation could enable an attacker to perform actions that should be restricted to higher-privileged users, such as modifying theme settings or accessing sensitive data. However, the vulnerability is assessed as low severity and is considered unlikely to be exploited in practice [1].

Mitigation

Status The Consultstreet theme has not been updated for two months and is unlikely to receive further patches [1]. Simply deactivating the theme does not eliminate the security risk; a mitigation rule from Patchstack is required to block exploitation. Users are advised to replace the theme with an alternative.