CVE-2025-62037

A missing authorization vulnerability exists in the uxper Togo WordPress theme, affecting versions from n/a through 1.0.4. The issue is due to a broken access control—specifically, a failure to properly check permissions or nonce tokens in certain functions, which can allow unprivileged users to execute higher-privileged actions [1].

Exploitation requires no authentication, making it accessible over the network. The CVSS v3 score of 6.5 (Medium) reflects moderate severity, but the vulnerability is expected to become actively exploited in mass campaigns targeting thousands of sites regardless of size or popularity [1].

An attacker can leverage this to bypass authorization checks and perform actions normally restricted to administrators, such as modifying theme settings or accessing sensitive data. The exact impact depends on the affected function, but broken access control in themes can lead to site compromise [1].

The vendor has released a fix in version 1.0.4 or later. Users are advised to update immediately. For those unable to update, Patchstack provides a mitigation rule to block attacks until a full patch is applied. Hosting providers or web developers can assist with the update process [1].