CVE-2025-62028

Vulnerability

Overview

CVE-2025-62028 is a missing authorization vulnerability in the Salient WordPress theme by ThemeNectar, affecting versions from n/a through 17.4.0. The issue stems from broken access control — specifically, a missing check for proper authorization or nonce tokens in a function, allowing unprivileged users to execute actions intended for higher-privilege roles [1].

Attack

Vector

The vulnerability can be exploited remotely without authentication, leveraging the broken access control to perform unauthorized actions. Attackers can target any site running the vulnerable theme version, and such flaws are frequently used in mass-exploit campaigns against thousands of websites [1].

Impact

Successful exploitation enables an attacker to bypass authorization restrictions and carry out actions that should only be available to authenticated users with elevated permissions. This could include modifying site content, settings, or other sensitive operations depending on the affected functionality.

Mitigation

ThemeNectar has released version 17.4.0 which addresses the issue. Users are strongly advised to update immediately. If updating is not possible, contacting a hosting provider or web developer for assistance is recommended [1].