What is the CVSS score of CVE-2025-67586?

CVE-2025-67586 has a CVSS 3.1 base score of 4.7 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 1.7%.

Is there a public PoC exploit available for CVE-2025-67586?

Yes, a public proof-of-concept exploit is available for CVE-2025-67586. Prioritise patching immediately. EPSS: 1.7%.

Highlight and Share CVE-2025-67586

Q: Which versions of Highlight and Share are affected by CVE-2025-67586?

The Highlight and Share WordPress plugin up to version 5.2.0 contains a missing authorization vulnerability that allows unauthenticated attackers to bypass access controls.

MEDIUM

Missing Authorization (CWE-862)

2025-12-09 audit@patchstack.com

WordPress Authentication Bypass Wordpress Plugin

4.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.7 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

4.7 MEDIUM

Requires social engineering to trick a user into clicking a link; no privileges needed; impact limited to low confidentiality and integrity.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 17:30 vuln.today

CVE Published

Dec 09, 2025 - 16:18 cve.org

MEDIUM 4.7

DescriptionCVE.org

Missing Authorization vulnerability in Ronald Huereca Highlight and Share highlight-and-share allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Highlight and Share: from n/a through <= 5.2.0.

AnalysisAI

The Highlight and Share WordPress plugin up to version 5.2.0 contains a missing authorization vulnerability that allows unauthenticated attackers to bypass access controls. Exploitation requires user interaction and can lead to unauthorized modification of plugin settings or limited information disclosure. Publicly available exploit code exists, but the vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities catalog.

Technical ContextAI

The vulnerability resides in the highlight-and-share WordPress plugin and is classified as CWE-862: Missing Authorization. This indicates that certain plugin actions (such as AJAX handlers or REST API endpoints) lack proper capability checks, allowing requests to be processed without verifying the user's permissions. The 'incorrectly configured access control security levels' mentioned in the description suggest that the plugin's role-based access controls are misapplied, enabling unauthenticated requests to perform actions that should require higher privileges.

Affected ProductsAI

Highlight and Share WordPress plugin versions n/a through 5.2.0 are affected. The CPE is not provided in the source data, but the advisory from Patchstack (https://patchstack.com/database/Wordpress/Plugin/highlight-and-share/vulnerability/wordpress-highlight-and-share-plugin-5-2-0-broken-access-control-vulnerability?_s_id=cve) confirms the exact version range.

RemediationAI

No vendor-released patch version has been confirmed at the time of this analysis. Monitor the Patchstack advisory for an update that fixes this issue (likely a version beyond 5.2.0). Until a patched version is available, consider disabling the Highlight and Share plugin if it is not essential. If the plugin must remain active, implement web application firewall rules to block known exploit patterns (as documented in the public exploit) and educate administrators not to click unsolicited links while logged into WordPress. The Exploit-DB entry (52511) can be used to develop detection signatures.