What is the CVSS score of CVE-2025-68036?

CVE-2025-68036 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Wordpress Plugin CVE-2025-68036

Q: Which versions of Wordpress Plugin are affected by CVE-2025-68036?

CubeWP framework plugin through version 1.1.27 fails to enforce proper access control checks, allowing attackers to access functionality that should be restricted by access control lists.

HIGH

Missing Authorization (CWE-862)

2025-12-30 audit@patchstack.com

WordPress Authentication Bypass Wordpress Plugin

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:43 vuln.today

cvss_changed

CVSS changed

Apr 23, 2026 - 15:43 NVD

7.5 (HIGH)

Analysis Generated

Apr 01, 2026 - 17:44 vuln.today

CVE Published

Dec 30, 2025 - 00:15 nvd

N/A

DescriptionCVE.org

Missing Authorization vulnerability in Imran Tauqeer CubeWP cubewp-framework allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects CubeWP: from n/a through <= 1.1.27.

AnalysisAI

CubeWP framework plugin through version 1.1.27 fails to enforce proper access control checks, allowing attackers to access functionality that should be restricted by access control lists. This authentication bypass vulnerability has low real-world exploitation probability (EPSS 0.05%) but represents a fundamental authorization flaw in the plugin's architecture that could enable privilege escalation or unauthorized feature access depending on implementation context.

Technical ContextAI

The vulnerability stems from CWE-862 (Missing Authorization), which occurs when software fails to verify that a user is authorized to perform a requested action before executing it. In the CubeWP framework plugin (CPE: wp:cubewp-framework), this manifests as missing or incomplete access control list (ACL) enforcement on sensitive functionality. The WordPress plugin ecosystem relies heavily on role-based access control through capabilities checks (typically wp_verify_nonce and current_user_can functions), and this plugin fails to properly implement these checks on one or more endpoints or admin functions. This is distinct from an authentication bypass-the user may already be logged in, but the application does not verify they have permission to access specific features or data.

Affected ProductsAI

CubeWP framework plugin versions from the initial release through version 1.1.27 are affected. The plugin is distributed through WordPress.org and identified by the vendor name Imran Tauqeer. WordPress site administrators running CubeWP versions 1.1.27 or earlier are impacted. No specific CPE granularity beyond the plugin identifier is available in the provided data.

RemediationAI

Update the CubeWP framework plugin to a patched version released after 1.1.27. Visit the Patchstack vulnerability database at https://patchstack.com/database/Wordpress/Plugin/cubewp-framework/vulnerability/wordpress-cubewp-plugin-1-1-27-broken-access-control-vulnerability for the specific patched version number and installation instructions. As an interim workaround, WordPress administrators should review CubeWP plugin capabilities and restrict plugin access through WordPress role management, ensuring that only trusted users have the ability to interact with CubeWP features. Disable the plugin if it cannot be updated immediately and its functionality is not critical.