What is the CVSS score of CVE-2025-68988?

CVE-2025-68988 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Wordpress Plugin are affected by CVE-2025-68988?

CVE-2025-68988 affects the o2oe E-Invoice App Malaysia WordPress plugin (versions 1.3.0 and earlier), allowing unauthenticated remote attackers to retrieve embedded sensitive system information from…

How to fix or mitigate CVE-2025-68988?

Within 24 hours: Identify all WordPress installations running o2oe E-Invoice App Malaysia plugin and document current versions in use. Within 7 days: Disable or remove the plugin from all affected WordPress installations as no vendor patch is currently available; contact o2oe for patch availability timeline. Within 30 days: Once the vendor releases a patched version, update all instances to the latest available version and conduct a security audit to identify any sensitive data that may have been exposed.

Wordpress Plugin CVE-2025-68988

MEDIUM

Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497)

2025-12-30 audit@patchstack.com

WordPress Information Disclosure Wordpress Plugin

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Severity Changed

Apr 23, 2026 - 15:43 NVD

HIGH MEDIUM

CVSS changed

Apr 23, 2026 - 15:43 NVD

7.5 (HIGH) 5.3 (MEDIUM)

Analysis Generated

Apr 01, 2026 - 15:22 vuln.today

CVE Published

Dec 30, 2025 - 11:15 nvd

HIGH 7.5

DescriptionCVE.org

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in o2oe E-Invoice App Malaysia einvoiceapp-malaysia allows Retrieve Embedded Sensitive Data.This issue affects E-Invoice App Malaysia: from n/a through <= 1.3.0.

AnalysisAI

Unauthorized remote attackers can retrieve embedded sensitive system information from o2oe E-Invoice App Malaysia plugin versions 1.3.0 and earlier without authentication (CVSS:3.1 AV:N/AC:L/PR:N). The vulnerability exposes confidential data through information disclosure, with EPSS exploitation probability at 0.05% (14th percentile). No public exploit identified at time of analysis, though the low attack complexity and unauthenticated attack vector make exploitation straightforward for adversaries with network access to vulnerable WordPress installations.

Technical ContextAI

This vulnerability stems from CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), where the E-Invoice App Malaysia WordPress plugin fails to properly restrict access to sensitive system information embedded within the application. The plugin, designed for Malaysian e-invoicing compliance, likely exposes configuration data, API credentials, database connection strings, or other sensitive parameters through publicly accessible endpoints or insufficiently protected resources. The CVSS vector indicates network-accessible exploitation with low complexity, suggesting the sensitive data may be retrievable through direct HTTP requests to predictable URIs, exposed API endpoints, or improperly secured configuration files within the WordPress plugin directory structure. WordPress plugins commonly suffer from information disclosure when developers embed credentials or system details in JavaScript files, expose debug endpoints, or fail to implement proper access controls on administrative interfaces.

Affected ProductsAI

The vulnerability affects o2oe E-Invoice App Malaysia WordPress plugin in all versions up to and including version 1.3.0. This is a specialized plugin for Malaysian e-invoicing compliance used primarily by Malaysian businesses integrating with local tax authority systems. The vulnerability disclosure from Patchstack (audit@patchstack.com) references version 1.1.0 specifically in their database entry, though the CVE scope extends through version 1.3.0, indicating the flaw persists across multiple releases. Affected installations are WordPress sites with the einvoiceapp-malaysia plugin actively installed and accessible via network interfaces. Full vendor advisory available at https://patchstack.com/database/Wordpress/Plugin/einvoiceapp-malaysia/vulnerability/wordpress-e-invoice-app-malaysia-plugin-1-1-0-sensitive-data-exposure-vulnerability.

RemediationAI

Users should immediately upgrade to E-Invoice App Malaysia plugin version 1.3.1 or later if available from the vendor o2oe. Verify patch availability through the WordPress plugin repository or directly from the vendor before deployment. As an interim workaround pending patch deployment, administrators should implement network-level access controls restricting plugin endpoints to authorized IP addresses only, deploy web application firewall rules blocking unauthorized access to sensitive plugin paths (typically wp-content/plugins/einvoiceapp-malaysia/*), and audit exposed configuration files for embedded credentials that should be rotated immediately. Review WordPress access logs for suspicious requests targeting the plugin directory to identify potential reconnaissance or exploitation attempts. After patching, conduct a security review to verify previously exposed sensitive data (API keys, database credentials, integration tokens) and rotate all potentially compromised credentials as a precautionary measure. Consult the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/einvoiceapp-malaysia/ for vendor-specific remediation guidance and confirmed fix versions.