What is the CVSS score of CVE-2025-68595?

CVE-2025-68595 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Wordpress Plugin are affected by CVE-2025-68595?

Trustindex Widgets for Social Photo Feed plugin (WordPress) versions through 1.8 contains a broken access control flaw (CVSS 8.8) that permits low-privilege authenticated users to execute…

How to fix or mitigate CVE-2025-68595?

Within 24 hours: Audit WordPress user roles and disable Editor/Author access for non-administrative users; document all active plugin installations and affected versions. Within 7 days: Contact Trustindex for patch timeline; implement Web Application Firewall (WAF) rules to restrict unauthorized API calls from low-privilege user agents if available. Within 30 days: Upgrade to patched version immediately upon vendor release, or deactivate Trustindex Widgets for Social Photo Feed if patch unavailable; conduct access control audit across all WordPress plugins.

Wordpress Plugin CVE-2025-68595

MEDIUM

Missing Authorization (CWE-862)

2025-12-24 audit@patchstack.com

WordPress Authentication Bypass Wordpress Plugin

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Severity Changed

Apr 23, 2026 - 15:43 NVD

HIGH MEDIUM

CVSS changed

Apr 23, 2026 - 15:43 NVD

8.8 (HIGH) 5.3 (MEDIUM)

Analysis Generated

Apr 01, 2026 - 15:22 vuln.today

CVE Published

Dec 24, 2025 - 13:16 nvd

HIGH 8.8

DescriptionCVE.org

Missing Authorization vulnerability in Trustindex Widgets for Social Photo Feed social-photo-feed-widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Widgets for Social Photo Feed: from n/a through <= 1.8.

AnalysisAI

Broken access control in Trustindex Widgets for Social Photo Feed (WordPress plugin) through version 1.8 allows authenticated attackers with low privileges to bypass authorization controls and execute high-impact actions. The vulnerability has low attack complexity (CVSS:3.1 AV:N/AC:L/PR:L) enabling compromise of confidentiality, integrity, and availability. EPSS score of 0.06% (18th percentile) indicates relatively low observed exploitation probability, and no public exploit or CISA KEV listing exists at time of analysis, suggesting this remains a patch-priority issue rather than an active threat.

Technical ContextAI

This vulnerability stems from CWE-862 (Missing Authorization), a common access control weakness in web applications where security checks are absent or improperly implemented on privileged functions. The WordPress plugin 'Widgets for Social Photo Feed' by Trustindex fails to validate whether authenticated users have appropriate permissions before granting access to sensitive operations. In WordPress plugin architecture, this typically manifests when admin-level or privileged API endpoints lack capability checks (such as current_user_can() validation), allowing any authenticated user-regardless of role-to invoke restricted functionality. The plugin integrates social media photo feeds into WordPress sites, and missing authorization on widget configuration, data modification, or administrative functions could allow subscriber-level users to manipulate settings, access sensitive data, or alter site content beyond their intended scope. This is a persistent authorization flaw affecting the core plugin logic rather than a configuration issue.

Affected ProductsAI

The vulnerability affects Trustindex Widgets for Social Photo Feed, a WordPress plugin identified by the slug 'social-photo-feed-widget'. All versions from the earliest release through version 1.8 are vulnerable to the missing authorization flaw. The vendor is Trustindex, and the product is distributed through the official WordPress.org plugin repository. WordPress site administrators running any version at or below 1.8 of this plugin should consider their installations affected, particularly environments where untrusted users have authenticated access at any privilege level (subscriber, contributor, author roles). The Patchstack advisory available at https://patchstack.com/database/Wordpress/Plugin/social-photo-feed-widget/vulnerability/wordpress-widgets-for-social-photo-feed-plugin-1-7-7-broken-access-control-vulnerability?_s_id=cve provides additional context, though the exact fixed version is not specified in the available data.

RemediationAI

WordPress administrators should immediately check their installed version of Widgets for Social Photo Feed and upgrade to the latest available version from the official WordPress plugin repository or the vendor's update channel. While the provided data confirms versions through 1.8 are affected, a specific patched release version is not independently confirmed from available intelligence. Administrators should consult the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/social-photo-feed-widget/vulnerability/wordpress-widgets-for-social-photo-feed-plugin-1-7-7-broken-access-control-vulnerability?_s_id=cve and the plugin's official changelog for the remediated version. As an interim mitigation, restrict authenticated user registration to trusted individuals only, review existing user accounts for suspicious low-privilege accounts, enable WordPress audit logging to detect unauthorized access attempts to administrative functions, and consider temporarily disabling the plugin if not essential to operations until a confirmed patch is applied. Implement principle of least privilege by limiting subscriber and contributor role assignments. Monitor WordPress admin activity logs for anomalous behavior from low-privileged accounts accessing widget configuration or related administrative areas.