CVE-2025-67572

Vulnerability

The PenNews WordPress theme suffers from a missing authorization vulnerability, classified as broken access control [1]. This flaw allows attackers to bypass intended security checks and perform actions that should require higher privileges. The vulnerability affects all versions prior to 6.7.4.

Exploitation

Attackers can exploit this issue without needing prior authentication or elevated permissions [1]. By sending specially crafted requests, they can invoke administrative functions or view sensitive content. The lack of proper authorization checks makes it possible for unprivileged users to execute actions reserved for administrators.

Impact

Successful exploitation can lead to unauthorized access to administrative interfaces, modification of website settings, or disclosure of confidential data. In some cases, this can result in full site takeover or inclusion in mass-exploit campaigns targeting thousands of websites [1].

Mitigation

The vulnerability is patched in version 6.7.4 of the PenNews theme. Users are strongly advised to update immediately. If updating is not possible, implement security measures such as restricting access to sensitive endpoints or using a web application firewall [1].