What is the CVSS score of CVE-2025-68608?

CVE-2025-68608 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.1%.

Userpro WordPress plugin CVE-2025-68608

Q: Which versions of Userpro WordPress plugin are affected by CVE-2025-68608?

Missing authorization in the Userpro WordPress plugin versions up to 5.1.9 allows unauthenticated attackers to modify plugin settings or user data via a crafted HTTP request.

HIGH

Missing Authorization (CWE-862)

2025-12-24 audit@patchstack.com

WordPress Authentication Bypass Wordpress Plugin

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

7.5 HIGH

Network vector, low attack complexity, no privileges or user interaction required; integrity impact only.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 16:12 vuln.today

CVE Published

Dec 24, 2025 - 13:16 cve.org

HIGH 7.5

DescriptionCVE.org

Missing Authorization vulnerability in DeluxeThemes Userpro userpro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Userpro: from n/a through <= 5.1.9.

AnalysisAI

Missing authorization in the Userpro WordPress plugin versions up to 5.1.9 allows unauthenticated attackers to modify plugin settings or user data via a crafted HTTP request. The vulnerability arises from incorrectly configured access control security levels, with integrity impact only. No public exploit or active exploitation has been identified at time of analysis.

Technical ContextAI

The vulnerability is a Missing Authorization issue (CWE-862) in the Userpro plugin, a membership and profile builder for WordPress. The underlying technology is PHP, likely involving WordPress REST API or admin-ajax endpoints where capability checks are absent. The CVSS vector indicates the flaw is exploitable over the network with low complexity, requiring no privileges or user interaction, and results in high integrity impact without affecting confidentiality or availability. The exact vulnerable endpoint is not disclosed, but typical patterns involve missing nonce or capability checks on plugin settings or user management functions.

Affected ProductsAI

Userpro plugin for WordPress versions from n/a through 5.1.9. No CPE strings were provided; advisory at https://patchstack.com/database/Wordpress/Plugin/userpro/vulnerability/wordpress-userpro-plugin-5-1-9-broken-access-control-vulnerability?_s_id=cve.

RemediationAI

Upgrade to Userpro version 5.1.10 or later, as the vulnerability is fixed in the next release after 5.1.9. If an immediate update is not possible, consider temporarily disabling the Userpro plugin or restricting access to its admin pages via IP whitelisting, but these actions may break front-end membership functionality. Refer to the Patchstack advisory for official guidance.