CVE-2025-64236
Published: 18 December 2025
Description
Authentication Bypass Using an Alternate Path or Channel vulnerability in AmentoTech Tuturn allows Authentication Abuse.This issue affects Tuturn: from n/a before 3.6.
Mitigating Controls (NIST 800-53 r5)AI
AC-14 explicitly identifies and permits only specific actions without identification or authentication, directly countering authentication bypass via alternate paths or channels in the Tuturn plugin.
AC-3 enforces approved authorizations for access to system resources, preventing unauthorized access through flawed authentication enforcement in the plugin.
SI-2 requires timely remediation of flaws, such as updating the Tuturn plugin to version 3.6 or later to eliminate the authentication bypass vulnerability.
Security SummaryAI
CVE-2025-64236 is an Authentication Bypass Using an Alternate Path or Channel vulnerability (CWE-288) in the Tuturn WordPress plugin developed by AmentoTech. This flaw enables authentication abuse and affects all versions of Tuturn prior to 3.6. The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its potential for complete system compromise without requiring user privileges or interaction.
An unauthenticated attacker can exploit this vulnerability remotely over the network with low complexity. Successful exploitation allows the attacker to bypass authentication mechanisms, potentially gaining unauthorized access to the plugin's functionality and, by extension, the underlying WordPress site. This could result in high-impact confidentiality, integrity, and availability violations, such as data exfiltration, modification of site content, or denial of service.
Patchstack's advisory for the Tuturn plugin highlights this as a broken authentication vulnerability fixed in version 3.6. Security practitioners should urge users to update to Tuturn 3.6 or later to mitigate the issue, as no other workarounds are specified in the available references.
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is an authentication bypass in a public-facing WordPress plugin, directly enabling exploitation of a public-facing application to gain unauthenticated administrative access.