CVE-2025-58004
BaseFortify
Publication date: 2025-09-22
Last updated on: 2026-04-23
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wordpress | dricub_theme | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-58004 is a Broken Access Control vulnerability in the WordPress DriCub Theme up to version 2.9. It occurs due to missing authorization, authentication, or nonce token checks, which allows unauthenticated users to perform actions that should be restricted to higher privileged users. This means attackers can exploit incorrectly configured access control security levels to gain unauthorized access or perform unauthorized actions. [1]
How can this vulnerability impact me? :
This vulnerability can allow unauthorized users to perform actions reserved for privileged users, potentially leading to unauthorized changes or misuse of the affected WordPress site. Although it has a low severity score (5.3) and is considered unlikely to be exploited, if exploited, it could compromise the integrity of the site by allowing unauthorized modifications or access. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
There are no specific commands provided to detect this vulnerability on your network or system. Plugin-based malware scanners may be unreliable for detecting this issue. It is recommended to seek professional incident response or hosting provider assistance for detection. [1]
What immediate steps should I take to mitigate this vulnerability?
Since no official fix or patched version is currently available, immediate mitigation can be done by applying Patchstack's virtual patching (vPatching), which automatically neutralizes the security risk without impacting performance. Additionally, users should seek professional incident response or hosting provider assistance if their sites are compromised. [1]