CVE-2025-64234 Overview
CVE-2025-64234 is a missing authorization vulnerability in the Evergreen Content Poster WordPress plugin. The flaw affects all versions up to and including 1.4.5. It stems from incorrectly configured access control on plugin functionality, categorized as CWE-862 Missing Authorization.
Authenticated users with low privileges can invoke functionality that should require higher authorization. The issue is exploitable over the network without user interaction. Impact is limited to availability, with no direct confidentiality or integrity impact according to the CVSS vector.
Critical Impact
An authenticated attacker with low privileges can abuse plugin actions lacking authorization checks, potentially disrupting site availability.
Affected Products
- Evergreen Content Poster WordPress plugin (evergreen-content-poster)
- All versions from n/a through <= 1.4.5
- WordPress installations with the vulnerable plugin activated
Discovery Timeline
- 2025-10-29 - CVE-2025-64234 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-64234
Vulnerability Analysis
The Evergreen Content Poster plugin exposes one or more actions without verifying whether the requesting user is authorized to perform them. The plugin registers handlers that check authentication but omit capability checks or nonce validation for privileged operations.
An attacker holding any authenticated account, such as a Subscriber, can send crafted requests to these handlers. The plugin executes the action without validating that the user's role permits it. This breaks the WordPress role and capability model that administrators rely on for privilege separation.
Root Cause
The root cause is missing authorization logic on plugin endpoints. WordPress plugins must call current_user_can() with an appropriate capability before executing privileged actions. When this check is absent, any authenticated session becomes sufficient to trigger the action.
The issue is tracked as CWE-862: Missing Authorization. Refer to the Patchstack WordPress Plugin Vulnerability advisory for vendor-specific detail.
Attack Vector
Exploitation requires network access to the WordPress site and a low-privileged authenticated account. The attacker submits an HTTP request to the vulnerable plugin endpoint, invoking a function that should be restricted. No user interaction is needed on the victim side. The verified impact is degradation of site availability.
No public proof-of-concept code is available. See the Patchstack advisory for technical details.
Detection Methods for CVE-2025-64234
Indicators of Compromise
- Unexpected POST requests to admin-ajax.php or plugin-specific endpoints originating from low-privileged user accounts
- Plugin actions executed by users whose roles do not include the corresponding capability
- Anomalous content posting activity or configuration changes tied to non-administrative accounts
Detection Strategies
- Audit WordPress access logs for authenticated requests targeting evergreen-content-poster handlers from Subscriber or Contributor accounts
- Correlate plugin activity in the WordPress database with the invoking user's role and capabilities
- Enable web application firewall rules that flag broken access control patterns against WordPress plugin endpoints
Monitoring Recommendations
- Forward WordPress and web server logs to a centralized logging platform for retention and correlation
- Alert on privilege escalation indicators such as low-role users invoking administrative plugin actions
- Monitor for the creation of new posts, scheduled jobs, or outbound connections triggered by non-editor accounts
How to Mitigate CVE-2025-64234
Immediate Actions Required
- Deactivate the Evergreen Content Poster plugin until a patched version above 1.4.5 is confirmed installed
- Review WordPress user accounts and remove or downgrade unnecessary low-privileged accounts
- Enforce strong authentication and rate limiting on wp-login.php to reduce the pool of usable authenticated sessions
Patch Information
As of the latest NVD update on 2026-06-17, the affected range is documented as n/a through <= 1.4.5. Consult the Patchstack advisory and the plugin's WordPress.org listing for the current fixed release, and apply it as soon as one is available.
Workarounds
- Restrict access to /wp-admin/ and admin-ajax.php at the web server or WAF layer where feasible
- Limit registration and disable open user signup on affected WordPress sites
- Remove the plugin entirely if it is not business-critical
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
