CVE-2025-62960 MEDIUM

CVE-2025-62960: WordPress Construction Light theme <= 1.6.7 - Broken Access Control vulnerability

Vendor Sparklewpthemes
Product Construction Light
Weakness CWE-862 · Missing authorization
Published December 18, 2025
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

5.4/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

What the vulnerability does

01Description

Missing Authorization vulnerability in sparklewpthemes Construction Light construction-light allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Construction Light: from n/a through <= 1.6.7.

Explanation of Vulnerability in Simple Terms

02Summary

Construction Light theme for WordPress contains an authorization bypass that allows authenticated users with low privileges to modify or delete site content they should not have access to. The vulnerability affects versions up to 1.6.7 and requires a valid user account to exploit. Site administrators should update to a version newer than 1.6.7 to remediate the issue.

What an attacker can do

03Attacker Capabilities

Modify or delete site content without proper permission checks.

Potential impact on your site

04Site Impact

Unauthorized users can alter or remove published content, potentially disrupting site integrity.

Conditions required to exploit

05Prerequisites

Attacker must have a valid low-privilege WordPress user account.

Key dates

06Disclosure timeline

December 18, 2025 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-12119 Simple File List <= 6.3.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary File Operations (Deletion / Move / Folder Creation / Download) via 'frontmanage' Shortcode Attribute CVE-2026-12557 Ninja Forms - File Uploads <= 3.3.29 - Missing Authorization to Unauthenticated Log Disclosure and Deletion via debug-log/delete-all and debug-log/get-all REST Endpoints CVE-2026-57688 WordPress POS Entegratör plugin <= 3.7.103 - Broken Access Control vulnerability CVE-2026-3462 Frisbii Pay <= 1.8.9 - Missing Authorization to Authenticated (Subscriber+) Payment Token Modification CVE-2026-11600 Envo's Templates & Widgets for Elementor and WooCommerce <= 1.4.26 - Missing Authorization to Authenticated (Author+) Private Content Disclosure via Envo Tabs Widget 'templates' Setting