CVE-2025-62017
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
The KALLYAS theme for WordPress is vulnerable to missing authorization in versions up to and including 4.22.0. This vulnerability may allow unauthorized access to functions or data.
Risk Assessment
An attacker could exploit the missing authorization to gain access to unauthorized functions or data, potentially leading to security breaches.
Recommendation
Update the KALLYAS theme to the latest version that includes the fix.
Other vulnerabilities in KALLYAS
See all- CVE-2025-63061Medium
The KALLYAS theme (versions below 4.25.0) contains a DOM-Based Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. A malicious script can be executed in the user's browser through DOM manipulation.
- CVE-2025-63060Medium
The KALLYAS plugin (by hogash) is vulnerable to Cross-Site Request Forgery (CSRF). This issue affects KALLYAS versions from n/a through < 4.25.0.
- CVE-2025-62018Medium
Missing Authorization vulnerability in hogash KALLYAS kallyas. This issue affects KALLYAS from n/a through <= 4.22.0.
Original NVD description (English source)
Missing Authorization vulnerability in hogash KALLYAS kallyas.This issue affects KALLYAS: from n/a through <= 4.22.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS