CVE-2025-67573

The Sailing theme for WordPress (versions prior to 4.4.6) contains a missing authorization vulnerability [1]. This means that certain functions or endpoints lack proper access control checks, allowing users without the required privileges to perform actions that should be restricted. The issue is classified as a broken access control vulnerability, which can be exploited by sending crafted requests to vulnerable endpoints without authentication [1]. Attackers can leverage this in mass-exploit campaigns targeting thousands of WordPress sites, regardless of traffic size or popularity.

Successful exploitation could allow an attacker to perform unauthorized actions, such as modifying settings or accessing sensitive data, depending on the specific missing authorization. The CVSS score of 5.3 indicates medium severity, reflecting the potential for unauthorized access but not full system compromise.

Mitigation is straightforward: the vendor has released version 4.4.6 to address the issue. Users are strongly advised to update immediately. If unable to update, consult a hosting provider or web developer for assistance [1].