CVE-2025-69393
Missing Authorization in Jthemes Exzo ≤1.2.4 Enables Unauthorized Access
Publication date: 2026-02-20
Last updated on: 2026-04-27
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| jthemes | exzo | to 1.2.4 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-69393 is a high-priority Broken Access Control vulnerability in the WordPress Exzo Theme versions up to and including 1.2.4.
It arises from missing authorization, authentication, or nonce token checks within certain functions, which allows unauthenticated users to perform actions that normally require higher privileges.
This means that attackers can exploit incorrectly configured access control security levels to bypass restrictions.
How can this vulnerability impact me? :
This vulnerability can have a significant impact because it allows unauthenticated users to perform privileged actions on a website using the Exzo Theme.
Such unauthorized actions could lead to unauthorized data access, modification, or other malicious activities that compromise the security and integrity of the affected website.
Given its CVSS severity score of 7.5, the risk and likelihood of exploitation are high.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability arises from missing authorization, authentication, or nonce token checks within certain functions of the WordPress Exzo Theme up to version 1.2.4, allowing unauthenticated users to perform privileged actions.
No specific detection commands or network/system scanning methods are provided in the available information.
What immediate steps should I take to mitigate this vulnerability?
Since no official patch is currently available for this vulnerability, immediate mitigation involves implementing the Patchstack mitigation rule that blocks attacks exploiting this flaw.
Users are strongly advised to apply this mitigation promptly to secure their websites until an official patch can be developed, tested, and safely applied.