What is the CVSS score of CVE-2025-68861?

CVE-2025-68861 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H. EPSS exploitation probability: 0.1%.

Wordpress Plugin CVE-2025-68861

Q: Which versions of Wordpress Plugin are affected by CVE-2025-68861?

Missing authorization in Plugin Optimizer WordPress plugin through version 1.3.7 allows attackers to exploit incorrectly configured access controls to perform unauthorized actions.

HIGH

Missing Authorization (CWE-862)

2025-12-29 audit@patchstack.com

WordPress Authentication Bypass Wordpress Plugin

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:43 vuln.today

cvss_changed

CVSS changed

Apr 23, 2026 - 15:43 NVD

7.1 (HIGH)

Analysis Generated

Apr 01, 2026 - 17:44 vuln.today

CVE Published

Dec 29, 2025 - 18:15 nvd

N/A

DescriptionCVE.org

Missing Authorization vulnerability in pluginoptimizer Plugin Optimizer plugin-optimizer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Plugin Optimizer: from n/a through <= 1.3.7.

AnalysisAI

Missing authorization in Plugin Optimizer WordPress plugin through version 1.3.7 allows attackers to exploit incorrectly configured access controls to perform unauthorized actions. The vulnerability stems from improper authentication validation (CWE-862), enabling attackers to bypass security restrictions without proper administrative privileges. While EPSS scoring (0.06%, 17th percentile) indicates low exploitation probability, the authentication bypass classification warrants prompt patching.

Technical ContextAI

Plugin Optimizer is a WordPress plugin designed to optimize WordPress site performance and configuration. The vulnerability involves a missing authorization check in one or more plugin functions, classified under CWE-862 (Missing Authorization). This allows attackers to call privileged functions or access restricted resources without satisfying the expected permission validation logic. WordPress plugins rely on capability checks using functions like current_user_can() to enforce role-based access control; this vulnerability indicates such checks are either absent or incorrectly implemented in certain code paths, allowing unauthenticated or low-privileged users to escalate their access.

Affected ProductsAI

Plugin Optimizer (WordPress plugin) versions from an unspecified baseline through 1.3.7 are affected. The exact initial affected version is not documented. The plugin is distributed via the WordPress plugin repository and identified by the CPE context of WordPress plugin-optimizer. Affected users should identify their installed version in the WordPress admin dashboard (Plugins > Installed Plugins) and compare against the vendor advisory at https://patchstack.com/database/Wordpress/Plugin/plugin-optimizer/vulnerability/wordpress-plugin-optimizer-plugin-1-3-7-broken-access-control-vulnerability?_s_id=cve.

RemediationAI

Update Plugin Optimizer to a version newer than 1.3.7; the vendor advisory does not specify the exact patched version number, so users should download the latest available release from the WordPress plugin repository or the vendor's website. To remediate, log in to the WordPress dashboard, navigate to Plugins > Installed Plugins, locate Plugin Optimizer, and click Update if available; if no update is visible, manually download the latest version from https://patchstack.com/database/Wordpress/Plugin/plugin-optimizer/vulnerability/wordpress-plugin-optimizer-plugin-1-3-7-broken-access-control-vulnerability?_s_id=cve or the official plugin page. As a temporary workaround until patching, restrict plugin administrator capabilities to trusted users only via WordPress user role management. Verify after upgrade that the authorization checks are properly enforced by testing access to plugin-specific features with non-administrator user roles.