What is the CVSS score of CVE-2025-68049?

CVE-2025-68049 has a CVSS 3.1 base score of 6.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

bunny.net WordPress Plugin CVE-2025-68049

EUVD-2025-210159 MEDIUM

Missing Authorization (CWE-862)

2026-06-15 Patchstack

GHSA-425q-6v6f-g643

WordPress Authentication Bypass Wordpress Plugin Bunny Net

6.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

6.3 MEDIUM

Subscriber account required (PR:L); network-accessible plugin endpoint with no interaction needed; limited CIA impact consistent with CDN configuration tampering.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 23:17 vuln.today

DescriptionCVE.org

Subscriber Broken Access Control in bunny.net <= 2.3.6 versions.

AnalysisAI

Broken Access Control in the bunny.net WordPress plugin (versions ≤ 2.3.6) enables subscriber-level authenticated users to invoke functionality restricted to higher-privileged roles, such as administrators. The root cause is CWE-862 (Missing Authorization) - the plugin fails to verify whether the authenticated requestor holds sufficient privileges before executing sensitive operations. Reported by Patchstack, this is a medium-severity finding (CVSS 6.3); no public exploit code and no CISA KEV listing have been identified at time of analysis, though the low barrier of a standard subscriber account on any affected WordPress site makes it noteworthy for multi-tenant or membership-based deployments.

Technical ContextAI

The affected component is the bunny.net WordPress plugin (CDN and performance optimization plugin by BunnyCDN), identified via CPE cpe:2.3:a:bunny.net:bunny.net:*:*:*:*:*:*:*:*. WordPress plugins interact with the WordPress REST API or admin-ajax endpoints and are expected to enforce capability checks (e.g., current_user_can()) before executing privileged logic. CWE-862 (Missing Authorization) indicates the plugin registers one or more AJAX actions, REST routes, or admin callbacks that omit these capability checks, allowing any authenticated user - including those with the default 'subscriber' role, which has minimal permissions - to trigger operations that should require 'editor', 'administrator', or custom high-privilege capabilities. The 'subscriber' role in WordPress is the lowest registered user tier, meaning exploitation requires only a standard site registration, which is often open on membership or WooCommerce sites.

RemediationAI

The primary remediation is to update the bunny.net WordPress plugin to the first version released after 2.3.6; consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/bunnycdn/vulnerability/wordpress-bunny-net-plugin-2-3-6-broken-access-control-vulnerability for the confirmed patched release version, as the exact fix version was not independently confirmed in the available input data. As a compensating control where immediate patching is not feasible, administrators should disable open user registration on the WordPress site (Settings > General > uncheck 'Anyone can register') to eliminate the low-barrier subscriber account creation vector - note this will block new user sign-ups as a trade-off. Additionally, reviewing and auditing existing subscriber-role accounts for unexpected or suspicious registrations is advised. A Web Application Firewall (WAF) rule restricting access to the specific plugin endpoints involved may reduce exposure but cannot fully substitute for the code-level authorization fix.