What is the CVSS score of CVE-2025-68588?

CVE-2025-68588 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Wordpress Plugin are affected by CVE-2025-68588?

TS Poll WordPress plugin versions 2.5.5 and earlier contain an access control vulnerability allowing authenticated subscribers to escalate privileges and modify poll data they should not access.

How to fix or mitigate CVE-2025-68588?

Within 24 hours: Disable or deactivate TS Poll plugin version 2.5.5 or earlier across all WordPress instances until an update is available; document the current version in use. Within 7 days: Monitor vendor advisory channels (WordPress plugin repository, TS Poll official sources) for patch release; contact the plugin vendor to request a security update timeline if none is published. Within 30 days: If patch is released, test in staging environment and deploy to production; if no patch emerges, evaluate alternative poll plugins and plan migration or request vendor security commitment.

Wordpress Plugin CVE-2025-68588

MEDIUM

Missing Authorization (CWE-862)

2025-12-24 audit@patchstack.com

WordPress Authentication Bypass Wordpress Plugin

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Severity Changed

Apr 23, 2026 - 15:43 NVD

HIGH MEDIUM

CVSS changed

Apr 23, 2026 - 15:43 NVD

8.1 (HIGH) 4.3 (MEDIUM)

Analysis Generated

Apr 01, 2026 - 15:22 vuln.today

CVE Published

Dec 24, 2025 - 13:16 nvd

HIGH 8.1

DescriptionCVE.org

Missing Authorization vulnerability in totalsoft TS Poll poll-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TS Poll: from n/a through <= 2.5.5.

AnalysisAI

Access control bypass in TS Poll WordPress plugin (versions ≤2.5.5) allows low-privileged authenticated users to escalate privileges and gain unauthorized read/write access to poll data. Attackers with basic subscriber accounts can exploit misconfigured authorization checks to access or modify content beyond their intended permission level. EPSS exploitation probability is low (0.04%, 13th percentile), with no public exploit identified at time of analysis, suggesting limited immediate risk despite the 8.1 CVSS score.

Technical ContextAI

This vulnerability stems from CWE-862 (Missing Authorization), a server-side access control failure where the plugin fails to properly verify user permissions before granting access to sensitive operations. The WordPress plugin TS Poll (poll-wp) does not adequately enforce authorization checks on API endpoints or administrative functions, allowing authenticated users to bypass intended security boundaries. Unlike authentication bypass (CWE-287), this is a post-authentication authorization failure where the application incorrectly evaluates what an authenticated user is permitted to do. The CVSS vector indicates network-accessible exploitation with low complexity, requiring only low-level privileges (PR:L), meaning any registered WordPress user account can potentially exploit this flaw without specialized knowledge or complex attack chains.

Affected ProductsAI

The vulnerability affects TS Poll (poll-wp), a WordPress polling plugin developed by TotalSoft, in all versions from the initial release through version 2.5.5 inclusive. The product identifier is the WordPress plugin slug 'poll-wp' available through the official WordPress.org plugin repository. According to Patchstack intelligence, version 2.5.3 was explicitly identified during security research, with the vulnerability persisting through the 2.5.5 release line. Organizations should check their WordPress plugin management dashboard for installations of TS Poll at or below version 2.5.5. The vendor advisory and technical details are available through Patchstack's vulnerability database at the referenced URL.

RemediationAI

Immediately update TS Poll plugin to a version newer than 2.5.5 once the vendor releases a patched version addressing this authorization flaw. Check the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/poll-wp/vulnerability/wordpress-ts-poll-plugin-2-5-3-broken-access-control-vulnerability for the specific fixed version number and vendor patch status. As interim mitigation if patches are unavailable, restrict WordPress user registration to trusted users only by disabling public registration in WordPress Settings > General, and audit existing user accounts to remove unnecessary low-privileged accounts that could exploit this vulnerability. Review poll configurations to ensure sensitive data is not stored or processed through the plugin until patching is complete. Consider temporarily deactivating the plugin if polls are non-essential to business operations. Implement WordPress security plugins with role-based access control monitoring to detect unauthorized privilege escalation attempts.