What is the CVSS score of CVE-2025-68980?

CVE-2025-68980 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

WeDesignTech Portfolio CVE-2025-68980

Q: Which versions of WeDesignTech Portfolio are affected by CVE-2025-68980?

Missing authorization in WeDesignTech Portfolio plugin for WordPress allows unauthenticated attackers to modify certain data through improperly protected endpoints.

MEDIUM

Missing Authorization (CWE-862)

2025-12-30 audit@patchstack.com

WordPress Authentication Bypass Wordpress Plugin

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.3 MEDIUM

Network accessible, low attack complexity, no privileges required, only integrity affected with no other impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 15:51 vuln.today

DescriptionCVE.org

Missing Authorization vulnerability in designthemes WeDesignTech Portfolio wedesigntech-portfolio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WeDesignTech Portfolio: from n/a through <= 1.0.2.

AnalysisAI

Missing authorization in WeDesignTech Portfolio plugin for WordPress allows unauthenticated attackers to modify certain data through improperly protected endpoints. All versions up to and including 1.0.2 are affected. There is no evidence of active exploitation or public proof-of-concept, and the low EPSS score indicates a low probability of widespread exploitation.

Technical ContextAI

The plugin is built for WordPress, typically exposing REST API or AJAX endpoints that handle portfolio content. Vulnerability class CWE-862 (Missing Authorization) indicates a function intended to require authentication operates without proper permission checks, allowing direct unauthenticated access. The affected product is identified by the CPE string cpe:2.3:a:designthemes:wedesigntech-portfolio:*:*:*:*:*:wordpress:*:* up to version 1.0.2.

Affected ProductsAI

WeDesignTech Portfolio plugin for WordPress versions up to and including 1.0.2. The vulnerability is documented in Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/wedesigntech-portfolio/vulnerability/wordpress-wedesigntech-portfolio-plugin-1-0-2-broken-access-control-vulnerability?_s_id=cve.

RemediationAI

A vendor-released patched version is not confirmed in the provided data. Monitor the Patchstack advisory for an updated version number. Until a fix is available, disable the plugin if it is not essential to site operations. If disabling is not possible, implement a Web Application Firewall (WAF) rule to block requests to the plugin’s known unauthenticated endpoints or restrict access to the WordPress REST API/ wp-admin directory for unauthenticated users. Note that these mitigations may interfere with legitimate front-end functionality of the plugin.