What is the CVSS score of CVE-2025-68577?

CVE-2025-68577 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

Virusdie CVE-2025-68577

MEDIUM

Missing Authorization (CWE-862)

2025-12-24 audit@patchstack.com

WordPress Authentication Bypass Wordpress Plugin

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Low-privilege authenticated remote attacker can modify plugin settings without user interaction, no confidentiality or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 16:17 vuln.today

DescriptionCVE.org

Missing Authorization vulnerability in Virusdie Virusdie virusdie allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Virusdie: from n/a through <= 1.1.6.

AnalysisAI

Missing authorization in the Virusdie WordPress plugin (≤ 1.1.6) allows authenticated low-privilege users to exploit incorrectly configured access controls, potentially leading to unauthorized changes to plugin settings. The vulnerability is not known to be actively exploited, with a low EPSS score (0.06%), and no public exploit code has been identified at time of analysis.

Technical ContextAI

The Virusdie plugin operates within the WordPress ecosystem, which relies on a role-based permission model enforced via capability checks on AJAX endpoints and admin pages. CWE-862 (Missing Authorization) indicates that the plugin fails to properly verify that a user has the necessary permissions before allowing access to a sensitive function, likely an AJAX action or REST API endpoint. The vulnerability stems from insufficient access control validation in the plugin's code, allowing attackers with low-privilege roles (e.g., subscriber) to manipulate configuration settings that should be restricted to administrators. The affected product is a WordPress security plugin, which, when compromised, could undermine site security.

Affected ProductsAI

Virusdie plugin for WordPress, all versions from n/a through 1.1.6, as reported by Patchstack (https://patchstack.com/database/Wordpress/Plugin/virusdie/vulnerability/wordpress-virusdie-plugin-1-1-6-broken-access-control-vulnerability?_s_id=cve). The vulnerable component is a missing authorization check, not tied to a specific CPE entry but applicable to the plugin's installations on any WordPress site.

RemediationAI

Update the Virusdie plugin to the latest version immediately. While the exact patched version is not confirmed in the advisory, the vulnerability affects versions up to 1.1.6, so any version above that (likely 1.1.7 or newer) should contain the fix. Administrators can obtain the update from the WordPress plugin repository or the developer's site. As a temporary workaround, restrict low-level user roles from accessing plugin settings via a role management plugin, but this only limits the attack surface and does not eliminate the vulnerability; applying the update is the only complete solution.