CVE-2025-63018CWE-862

WordPress Bard theme <= 2.229 - Broken Access Control vulnerability

Medium · published January 22, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
21.6
In the wild
Unconfirmed
What it is

⚠️ Missing Authorization alert! This vulnerability in wproyal Bard allows sneaky access for unauthorized users, opening the door to potential data mishaps. 💥 Consider it like a restaurant where anyone can walk into the kitchen and peek at the secret recipes — without proper authorization checks, sensitive data could be exposed to prying eyes. In the wrong hands, this could lead to unauthorized access to sensitive information or administrative functions, which, while not catastrophic, could result in data leaks or misuse. Imagine someone meddling with your order while you’re not looking; definitely not ideal!

Put simply

Consider it like a restaurant where anyone can walk into the kitchen and peek at the secret recipes — without proper authorization checks, sensitive data could be exposed to prying eyes. The missing authorization flaw in wproyal Bard means that certain access controls can be bypassed, allowing users to gain privileges they shouldn’t have. This weakness impacts versions up to 2.229, leaving them vulnerable to unauthorized actions.

What to do

In the wrong hands, this could lead to unauthorized access to sensitive information or administrative functions, which, while not catastrophic, could result in data leaks or misuse. Imagine someone meddling with your order while you’re not looking; definitely not ideal! To mitigate this issue, ensure that access control settings are correctly configured. Update to the patched version of wproyal Bard once available, and conduct a security review of your access controls. Don't let your guards down! You've got this! Stay proactive, and with these steps, you’ll bolster your defenses in no time! 🛡️

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00300 · 21.6th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-01-22T16:51Z
EPSS history
Timeline
  • 22 JAN 16:51Z
    WordPress Bard theme <= 2.229 - Broken Access Control vulnerability
    cvelistv5