CVE-2025-64259
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
The Theater for WordPress plugin has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. The issue affects versions up to and including 0.18.8.
Risk Assessment
Unauthorized users may gain access to plugin functionality, potentially leading to unauthorized changes to content or configuration.
Recommendation
Update the plugin to a patched version. Review permission settings and restrict access to sensitive functions.
Other vulnerabilities in Theater for WordPress
See all- CVE-2025-69331Medium
The Theater for WordPress plugin (versions up to and including 0.19) contains a Missing Authorization vulnerability due to incorrectly configured access control security levels. This allows exploitation of improperly configured authorization mechanisms.
- CVE-2025-58020Medium
The Theater for WordPress plugin (versions up to 0.18.8) is vulnerable to stored XSS due to improper input neutralization during web page generation. Attackers can inject malicious scripts.
Original NVD description (English source)
Missing Authorization vulnerability in Jeroen Schmit Theater for WordPress theatre allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Theater for WordPress: from n/a through <= 0.18.8.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS