What is the CVSS score of CVE-2025-68834?

CVE-2025-68834 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Sync Master Sheet are affected by CVE-2025-68834?

An unpatched vulnerability in the Sync Master Sheet WooCommerce plugin (versions ≤1.1.3) permits unauthenticated attackers to modify business-critical e-commerce data including customer orders and…

How to fix or mitigate CVE-2025-68834?

Within 24 hours: identify all WooCommerce instances using Sync Master Sheet plugin versions 1.1.3 or earlier and disable the plugin immediately; review database audit logs for any unauthorized modifications in recent weeks. Within 7 days: implement Web Application Firewall (WAF) rules to block unauthenticated access to plugin functions; enable database activity monitoring with real-time alerts on data modifications; restrict database user accounts to minimum required privileges. Within 30 days: monitor Patchstack security advisories and the plugin repository for patch release (monitor for versions 1.1.4+); evaluate alternative WooCommerce sync solutions if patch availability remains uncertain.

Sync Master Sheet CVE-2025-68834

HIGH

Missing Authorization (CWE-862)

2026-02-20 audit@patchstack.com

WordPress Authentication Bypass Google

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

7.5 HIGH

Unauthenticated network-reachable missing-authorization handler (PR:N/UI:N/AC:L) yielding data modification with no read or availability impact, so I:H and C:N/A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

CVSS changed

Apr 23, 2026 - 15:43 NVD

7.5 (HIGH)

Analysis Generated

Mar 12, 2026 - 22:04 vuln.today

CVE Published

Feb 20, 2026 - 16:22 nvd

N/A

CVE Published

Feb 20, 2026 - 16:22 cve.org

HIGH 7.5

DescriptionCVE.org

Missing Authorization vulnerability in Saiful Islam Sync Master Sheet – Product Sync with Google Sheet for WooCommerce product-sync-master-sheet allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sync Master Sheet – Product Sync with Google Sheet for WooCommerce: from n/a through <= 1.1.3.

AnalysisAI

Broken access control in the Sync Master Sheet - Product Sync with Google Sheet for WooCommerce plugin (versions up to and including 1.1.3) lets unauthenticated remote attackers invoke privileged plugin functions that lack proper authorization checks, allowing them to modify data (high integrity impact) without valid credentials. The flaw was reported by Patchstack and carries a CVSS 7.5; no public exploit identified at time of analysis and EPSS is very low (0.02%, 6th percentile), indicating no observed exploitation activity yet.

Technical ContextAI

The affected component is a WordPress plugin that synchronizes WooCommerce product data with Google Sheets. The root cause is CWE-862 (Missing Authorization): one or more plugin actions (typically AJAX or admin-post handlers, or REST endpoints) execute their logic without verifying that the caller holds the required capability or role. In WordPress plugins this usually manifests as handlers registered without a current_user_can() capability check (and often without a nonce), so any visitor can trigger operations meant to be restricted to shop managers or administrators - here specifically the product-sync operations exposed by the plugin.

Affected ProductsAI

Sync Master Sheet - Product Sync with Google Sheet for WooCommerce (plugin slug product-sync-master-sheet) by Saiful Islam, all versions from an unspecified initial release up to and including 1.1.3, running as a WordPress/WooCommerce plugin. No CPE string was provided in the source data. The reference and advisory detail are available from Patchstack: https://patchstack.com/database/Wordpress/Plugin/product-sync-master-sheet/vulnerability/wordpress-sync-master-sheet-product-sync-with-google-sheet-for-woocommerce-plugin-1-1-3-broken-access-control-vulnerability

RemediationAI

No fixed version is stated in the available data, so no vendor-released patch is identified at time of analysis; monitor the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/product-sync-master-sheet/vulnerability/wordpress-sync-master-sheet-product-sync-with-google-sheet-for-woocommerce-plugin-1-1-3-broken-access-control-vulnerability) and the plugin's WordPress.org page for a release above 1.1.3 and upgrade as soon as one ships. Until a patched version is available, the most effective compensating control is to deactivate and remove the plugin if the Google Sheets sync feature is not essential, accepting loss of automated product synchronization; if it must stay active, restrict access at the web-application-firewall or reverse-proxy layer by blocking or authenticating requests to the plugin's admin-ajax actions and any custom REST routes it registers, with the trade-off that legitimate sync automation may need allow-listed source IPs. Enabling a virtual-patching WAF such as Patchstack for this specific CVE is a lower-friction stopgap that preserves functionality.