Medium · 5.3 CVE-2025-67572 EUVD-2025-202074GHSA-rgqg-hgw2-9cww

WordPress PenNews theme < 6.7.4 - Broken Access Control vulnerability

Published Dec 9, 2025 · Updated Apr 28, 2026 · Assigned by Patchstack

Description

Missing Authorization vulnerability in PenciDesign PenNews pennews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PenNews: from n/a through < 6.7.4.

Affected products

Vendor	Product	Affected	Fixed
PenciDesign	PenNews	≤ 6.7.4	—

References

https://patchstack.com/database/Wordpress/Theme/pennews/vulnerability/wordpress-pennews-theme-6-7-4-broken-access-control-vulnerability?_s_id=cve vdb-entry