CVE-2025-62064
Published: 06 November 2025
Description
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Security Summary
CVE-2025-62064 is an Authentication Bypass Using an Alternate Path or Channel vulnerability (CWE-288) in the Search & Go WordPress theme developed by Elated-Themes. The flaw, published on 2025-11-06, affects the search-and-go theme from its initial release (n/a) through version 2.7 inclusive and enables password recovery exploitation.
With a CVSS v3.1 base score of 9.8 (Critical), the vulnerability allows exploitation over the network (AV:N) with low complexity (AC:L), requiring no privileges (PR:N) or user interaction (UI:N), and results in high impacts to confidentiality, integrity, and availability (C:H/I:H/A:H). Unauthenticated remote attackers can exploit it to bypass authentication via an alternate path or channel, leveraging password recovery to gain unauthorized access.
The Patchstack advisory provides details on the vulnerability and mitigation at https://patchstack.com/database/Wordpress/Theme/search-and-go/vulnerability/wordpress-search-go-theme-2-7-broken-authentication-vulnerability?_s_id=cve.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The vulnerability is an authentication bypass in a public-facing WordPress theme, directly enabling exploitation of a public-facing application.