WordPress CVE-2025-68993

MEDIUM

Missing Authorization (CWE-862)

2025-12-30 audit@patchstack.com

WordPress Authentication Bypass

5.3

CVSS 3.1 · NVD

Share

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

2

Analysis Generated

Jul 26, 2026 - 15:49 vuln.today

CVE Published

Dec 30, 2025 - 11:15 cve.org

MEDIUM 5.3

DescriptionCVE.org

Missing Authorization vulnerability in XforWooCommerce Share, Print and PDF Products for WooCommerce share-print-pdf-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Share, Print and PDF Products for WooCommerce: from n/a through <= 3.1.2.

AnalysisAI

Unauthenticated information disclosure in the Share Print PDF for WooCommerce plugin ≤ 3.1.2 allows remote attackers to access restricted product data via a missing authorization check (CWE-862). The vulnerability carries a CVSS 5.3 (medium) score but has an extremely low EPSS (0.04%), suggesting minimal exploitation likelihood. No active exploitation or public exploit code is known at this time.

More in WordPress

View all

CVE-2016-10033 CRITICAL Act Now POC

The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para

CVE-2016-10045 CRITICAL Act Now POC

The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman

CVE-2023-6553 CRITICAL Act Now POC

The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1

CVE-2024-5084 CRITICAL Act Now POC

The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil

CVE-2024-44000 CRITICAL Emergency POC

Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote

CVE-2024-8353 CRITICAL Act Now POC

The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all

CVE-2020-36847 CRITICAL Act Now POC

The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner

CVE-2025-11749 CRITICAL Emergency POC

The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint

CVE-2025-27007 CRITICAL Emergency POC

The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut

CVE-2016-1209 CRITICAL Emergency POC

The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via

CVE-2024-4443 CRITICAL Act Now POC

The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based

CVE-2026-63030 CRITICAL Act Now POC

Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r

Same weakness CWE-862 – Missing Authorization

View all

CVE-2023-52163 HIGH POC

CVE-2025-6205 CRITICAL POC

CVE-2025-20362 HIGH POC

CVE-2017-9232 CRITICAL POC

CVE-2023-6875 CRITICAL POC

CVE-2024-4898 CRITICAL POC

CVE-2023-32117 CRITICAL POC

CVE-2020-36719 CRITICAL POC

Same technique Authentication Bypass

View all

CVE-2023-22515 CRITICAL POC

CVE-2012-4681 CRITICAL POC

CVE-2013-2465 CRITICAL POC

CVE-2011-3544 CRITICAL POC

CVE-2022-40684 CRITICAL POC

CVE-2025-61882 CRITICAL POC

CVE-2024-0012 CRITICAL POC

CVE-2023-46805 HIGH POC

Share

CVE-2025-68993 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy