What is the CVSS score of CVE-2025-68591?

CVE-2025-68591 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Wordpress Plugin are affected by CVE-2025-68591?

Simple File List WordPress plugin versions 6.1.18 and earlier contain an authorization flaw that allows low-privilege authenticated users to read and modify file list data they should not access,…

How to fix or mitigate CVE-2025-68591?

Within 24 hours: Identify all WordPress sites running Simple File List plugin versions 6.1.18 or earlier and document affected instances. Within 7 days: Restrict file list access via WordPress role/capability management to administrators only as a temporary control, and monitor user access logs for suspicious activity. Within 30 days: Monitor vendor advisory channels for patch availability; if patch is released, upgrade to the patched version immediately. If no patch is released within 30 days, evaluate alternative file management plugins or disable the plugin if operationally feasible.

Wordpress Plugin CVE-2025-68591

MEDIUM

Missing Authorization (CWE-862)

2025-12-24 audit@patchstack.com

WordPress Authentication Bypass Wordpress Plugin

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Severity Changed

Apr 23, 2026 - 15:43 NVD

HIGH MEDIUM

CVSS changed

Apr 23, 2026 - 15:43 NVD

8.1 (HIGH) 5.4 (MEDIUM)

Analysis Generated

Apr 01, 2026 - 15:22 vuln.today

CVE Published

Dec 24, 2025 - 13:16 nvd

HIGH 8.1

DescriptionCVE.org

Missing Authorization vulnerability in Mitchell Bennis Simple File List simple-file-list allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple File List: from n/a through <= 6.1.18.

AnalysisAI

Missing authorization in Simple File List WordPress plugin 6.1.18 and earlier allows authenticated low-privilege users to bypass access controls and gain unauthorized read/write access to file list data. Tagged as an authentication bypass vulnerability with EPSS score of 0.04% (13th percentile), indicating low observed exploitation probability. No active exploitation confirmed (not in CISA KEV), and no public exploit code identified at time of analysis.

Technical ContextAI

Simple File List is a WordPress plugin for managing and displaying file directories. This vulnerability stems from CWE-862 (Missing Authorization), where the plugin fails to properly validate user permissions before granting access to file management functions. The access control implementation incorrectly allows authenticated users with low-level privileges (such as Subscriber or Contributor roles) to perform actions that should be restricted to higher-privilege roles like Administrator. The CVSS vector indicates network-based exploitation (AV:N) with low attack complexity (AC:L), requiring only low-privilege authentication (PR:L) and no user interaction (UI:N). The vulnerability enables high confidentiality and integrity impacts without affecting availability, suggesting attackers can read sensitive files and modify file list configurations but cannot disrupt service availability.

Affected ProductsAI

Mitchell Bennis Simple File List WordPress plugin versions 6.1.18 and all earlier versions are affected by this missing authorization vulnerability. The CPE identifier for this product would follow the pattern cpe:2.3:a:mitchell_bennis:simple-file-list:*:*:*:*:*:wordpress:*:* with version ranges up to and including 6.1.18. The Patchstack reference database indicates version 6.1.15 was specifically analyzed for broken access control issues, suggesting the vulnerability has persisted through multiple releases. All WordPress installations running this plugin should be considered vulnerable until patched.

RemediationAI

WordPress administrators should immediately update the Simple File List plugin to version 6.1.19 or later if available. Check the official WordPress plugin repository or the vendor's website for the latest patched release addressing this authorization bypass. The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/simple-file-list/vulnerability/wordpress-simple-file-list-plugin-6-1-15-broken-access-control-vulnerability provides additional technical details and may include specific patch information. As an interim mitigation while waiting for patches, administrators should audit WordPress user roles and remove unnecessary low-privilege accounts, restrict plugin access to only trusted administrator accounts, and review file list permissions to ensure sensitive documents are not exposed through the plugin. Consider temporarily disabling the Simple File List plugin if it is not business-critical until a verified patch is deployed.