CVE-2025-62064
Published: 06 November 2025
Summary
CVE-2025-62064 is a critical-severity Authentication Bypass Using an Alternate Path or Channel (CWE-288) vulnerability. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 25.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement).
Deeper analysis
CVE-2025-62064 is an Authentication Bypass Using an Alternate Path or Channel vulnerability (CWE-288) in the Search & Go WordPress theme developed by Elated-Themes. The flaw, published on 2025-11-06, affects the search-and-go theme from its initial release (n/a) through version 2.7 inclusive and enables password recovery exploitation.
With a CVSS v3.1 base score of 9.8 (Critical), the vulnerability allows exploitation over the network (AV:N) with low complexity (AC:L), requiring no privileges (PR:N) or user interaction (UI:N), and results in high impacts to confidentiality, integrity, and availability (C:H/I:H/A:H). Unauthenticated remote attackers can exploit it to bypass authentication via an alternate path or channel, leveraging password recovery to gain unauthorized access.
The Patchstack advisory provides details on the vulnerability and mitigation at https://patchstack.com/database/Wordpress/Theme/search-and-go/vulnerability/wordpress-search-go-theme-2-7-broken-authentication-vulnerability?_s_id=cve.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-38069
Vulnerability details
Authentication Bypass Using an Alternate Path or Channel vulnerability in Elated-Themes Search & Go search-and-go allows Password Recovery Exploitation.This issue affects Search & Go: from n/a through <= 2.7.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is an authentication bypass in a public-facing WordPress theme, directly enabling exploitation of a public-facing application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces approved authorizations for logical access, directly preventing authentication bypass via alternate paths or channels in the Search & Go theme's password recovery.
Explicitly identifies and permits only approved actions without identification or authentication, mitigating exploitation of unintended unauthenticated paths like flawed password recovery.
Requires timely identification, reporting, and correction of flaws such as this critical authentication bypass in Search & Go versions through 2.7.