What is the CVSS score of CVE-2025-68521?

CVE-2025-68521 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

WpStream CVE-2025-68521

Q: Which versions of WpStream are affected by CVE-2025-68521?

Low-integrity unauthorized modification in WpStream plugin ≤4.9.5 allows unauthenticated remote attackers to alter plugin functionality via missing authorization checks.

MEDIUM

Missing Authorization (CWE-862)

2025-12-24 audit@patchstack.com

WordPress Authentication Bypass Wordpress Plugin

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.3 MEDIUM

Network attack vector with low complexity and no privileges; only integrity is impacted.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 16:22 vuln.today

DescriptionCVE.org

Missing Authorization vulnerability in wpstream WpStream wpstream allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpStream: from n/a through <= 4.9.5.

AnalysisAI

Low-integrity unauthorized modification in WpStream plugin ≤4.9.5 allows unauthenticated remote attackers to alter plugin functionality via missing authorization checks. The vulnerability, classified as CWE-862 Missing Authorization, enables attackers to exploit incorrectly configured access control levels, potentially changing streaming settings or data without any user interaction. No public exploit or active exploitation has been confirmed, and EPSS score is very low (0.06%).

Technical ContextAI

The vulnerability stems from a missing capability check (CWE-862) in WpStream, a WordPress live streaming plugin. Affected versions up to 4.9.5 expose endpoints (likely REST API routes or admin-ajax handlers) that fail to verify the user's authorization level before performing actions. This allows unauthenticated attackers to invoke privileged functions designed for authenticated users, such as modifying plugin configuration. The issue is network-accessible with low attack complexity, as indicated by the CVSS vector.

Affected ProductsAI

WpStream plugin for WordPress, versions from n/a through 4.9.5 inclusive. The vendor's Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/wpstream/vulnerability/wordpress-wpstream-plugin-4-9-5-broken-access-control-vulnerability?_s_id=cve provides further details, though no fixed version is listed in the provided data.

RemediationAI

Update WpStream to a version higher than 4.9.5 when available; check the official WordPress plugin repository or vendor changelog for a patched release. If no update is released, consider disabling the plugin if live streaming functionality is not critical, or restrict external access to WordPress REST API and admin-ajax endpoints associated with WpStream by IP whitelisting or web application firewall rules. Note: disabling the plugin removes streaming features; access controls may impact legitimate API consumers.