What is the CVSS score of CVE-2025-68589?

CVE-2025-68589 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Wordpress Plugin are affected by CVE-2025-68589?

The WP Telegram Widget and Join Link plugin (versions ≤2.2.12) contains a broken access control vulnerability that allows authenticated users with basic permissions to read and modify sensitive…

How to fix or mitigate CVE-2025-68589?

Within 24 hours: identify all WordPress installations running WP Telegram Widget and Join Link plugin and document current versions. Within 7 days: disable or remove the plugin from all systems running version 2.2.12 or earlier until a patched version is released; if the plugin is critical, restrict user roles that can access plugin settings to administrator-level accounts only via WordPress permission controls. Within 30 days: monitor vendor advisory channels for a patched version release, and immediately upgrade to the patched version once available; verify access controls are properly enforced post-upgrade.

Wordpress Plugin CVE-2025-68589

MEDIUM

Missing Authorization (CWE-862)

2025-12-24 audit@patchstack.com

WordPress Authentication Bypass Wordpress Plugin

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Severity Changed

Apr 23, 2026 - 15:43 NVD

HIGH MEDIUM

CVSS changed

Apr 23, 2026 - 15:43 NVD

8.1 (HIGH) 5.3 (MEDIUM)

Analysis Generated

Apr 01, 2026 - 15:22 vuln.today

CVE Published

Dec 24, 2025 - 13:16 nvd

HIGH 8.1

DescriptionCVE.org

Missing Authorization vulnerability in WP Socio WP Telegram Widget and Join Link wptelegram-widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Telegram Widget and Join Link: from n/a through <= 2.2.12.

AnalysisAI

Broken access control in WP Telegram Widget and Join Link plugin versions up to 2.2.12 allows authenticated users with low privileges to bypass authorization checks and access high-sensitivity configuration or data. The vulnerability enables unauthorized read and write operations (CVSS C:H/I:H) without requiring user interaction. EPSS score of 0.04% suggests low observed exploitation probability, and no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.

Technical ContextAI

This vulnerability stems from CWE-862 (Missing Authorization), a fundamental access control flaw where the WordPress plugin fails to properly verify user permissions before granting access to sensitive functions or data. The WP Telegram Widget and Join Link plugin integrates Telegram messaging features into WordPress sites, likely exposing widget configuration, join links, or channel management functionality. The missing authorization check allows any authenticated user-regardless of their WordPress role-to perform actions that should be restricted to administrators or specific privileged roles. This represents a horizontal or vertical privilege escalation vulnerability within the WordPress plugin ecosystem, where authentication (proving identity) exists but authorization (validating permissions) is improperly implemented or entirely absent.

Affected ProductsAI

WordPress plugin WP Telegram Widget and Join Link versions from earliest release through 2.2.12 are confirmed vulnerable. The plugin, developed by WP Socio, provides Telegram channel integration and join link widgets for WordPress sites. All installations running version 2.2.12 or earlier contain the missing authorization vulnerability. The Patchstack advisory references version 2.2.11 specifically in the URL but the CVE description confirms the issue persists through version 2.2.12. Site administrators running any version in this range should consider all authenticated users as potential threat actors for widget configuration manipulation. The vulnerability affects standard WordPress installations where the plugin is active, regardless of hosting environment or server configuration.

RemediationAI

Upgrade WP Telegram Widget and Join Link plugin to version 2.2.13 or later if available, as the CVE acknowledgment implies a fix version exists beyond 2.2.12. Access the WordPress admin dashboard, navigate to Plugins, and check for updates to wptelegram-widget. If no patched version appears available through the WordPress repository, temporarily deactivate the plugin until vendor confirmation of the fix. Review the Patchstack vulnerability database entry at https://patchstack.com/database/Wordpress/Plugin/wptelegram-widget/vulnerability/wordpress-wp-telegram-widget-and-join-link-plugin-2-2-11-broken-access-control-vulnerability for vendor-specific guidance and confirmed patch availability. As a temporary mitigation, restrict WordPress user registration or limit authenticated user accounts to trusted individuals only, and audit existing low-privilege accounts for suspicious activity. Implement WordPress security plugins with access control monitoring to detect unauthorized configuration changes.