What is the CVSS score of CVE-2025-68994?

CVE-2025-68994 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Product Loops for WooCommerce CVE-2025-68994

MEDIUM

Missing Authorization (CWE-862)

2025-12-30 audit@patchstack.com

WordPress Authentication Bypass

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Network-accessible, low complexity, no privileges, only low confidentiality impact without integrity or availability effects.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 15:49 vuln.today

CVE Published

Dec 30, 2025 - 11:15 cve.org

MEDIUM 5.3

DescriptionCVE.org

Missing Authorization vulnerability in XforWooCommerce Product Loops for WooCommerce product-loops allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Loops for WooCommerce: from n/a through <= 2.1.2.

AnalysisAI

Unauthorized information disclosure in XforWooCommerce Product Loops for WooCommerce versions up to 2.1.2 allows remote unauthenticated attackers to access restricted product loop data due to missing authorization checks. No active exploitation or public exploit is known, and EPSS indicates a very low probability of exploitation (0.04%). The vulnerability is classified as a missing authorization issue (CWE-862) with a CVSS 3.1 base score of 5.3 (Medium).

Technical ContextAI

The vulnerability stems from a missing authorization flaw (CWE-862) in the WordPress plugin 'Product Loops for WooCommerce' by XforWooCommerce. This plugin likely manages the display of WooCommerce product loops, and the missing authorization indicates that certain endpoints or data-access functions do not properly verify user capabilities before returning sensitive information. CPE data for this plugin is not explicitly provided, but it typically follows the pattern cpe:2.3:a:xforwoocommerce:product_loops:*:*:*:*:*:wordpress:*:*. The root cause is an incorrectly configured access control security level, allowing unauthenticated users to retrieve data that should be protected.

Affected ProductsAI

The vulnerability affects XforWooCommerce Product Loops for WooCommerce versions up to and including 2.1.2, as reported in the Patchstack database advisory (https://patchstack.com/database/Wordpress/Plugin/product-loops/vulnerability/wordpress-product-loops-for-woocommerce-plugin-2-1-2-broken-access-control-vulnerability?_s_id=cve). No specific CPE string is supplied, but the plugin's WordPress slug is 'product-loops'.

RemediationAI

No vendor-released patch version has been independently confirmed. Users should update to a version later than 2.1.2 if available, and consult the vendor's change log. As a temporary compensating control, consider disabling the Product Loops for WooCommerce plugin until a confirmed fix is deployed, especially if the site does not rely on its functionality. Restricting access to the WordPress admin area and enforcing strong network-level access controls can also reduce exposure, though the vulnerability is unauthenticated and does not require admin access.