What is the CVSS score of CVE-2025-68995?

CVE-2025-68995 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.0%.

Wordpress Plugin CVE-2025-68995

MEDIUM

Missing Authorization (CWE-862)

2025-12-30 audit@patchstack.com

WordPress Authentication Bypass Wordpress Plugin

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Apr 01, 2026 - 15:22 vuln.today

CVE Published

Dec 30, 2025 - 11:15 nvd

MEDIUM 4.3

DescriptionCVE.org

Missing Authorization vulnerability in Premio My Sticky Elements mystickyelements allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects My Sticky Elements: from n/a through <= 2.3.3.

AnalysisAI

Missing authorization in Premio My Sticky Elements plugin (version 2.3.3 and earlier) allows authenticated users to modify data they should not have access to due to incorrectly configured access control security levels. The vulnerability requires an authenticated attacker with low privileges and carries a CVSS score of 4.3 with low real-world exploitation probability (EPSS 0.04%). No public exploit code or active exploitation has been identified.

Technical ContextAI

The vulnerability stems from CWE-862 (Missing Authorization), a class of access control flaws where the application fails to properly enforce authorization checks before allowing sensitive operations. In the My Sticky Elements WordPress plugin, the access control security levels are misconfigured, enabling authenticated users with limited privileges to bypass intended restrictions and modify data outside their authorized scope. The plugin runs in the WordPress ecosystem where user roles and capabilities are fundamental to security; a broken authorization implementation undermines WordPress's permission model and allows privilege escalation through data manipulation.

Affected ProductsAI

Premio My Sticky Elements WordPress plugin from version 2.3.3 and earlier is affected. The plugin is distributed through the official WordPress plugin repository and installed via the wp-plugins ecosystem. Detailed advisory information is available from Patchstack's vulnerability database.

RemediationAI

Update the My Sticky Elements plugin to a version newer than 2.3.3, which should contain corrected access control configurations. Organizations should immediately review their WordPress user roles and ensure that only trusted administrators have plugin management access. The Patchstack advisory should be consulted for the exact patched version number and any interim workarounds prior to updating. Users running version 2.3.3 or earlier on WordPress installations with multiple user accounts should prioritize this update to prevent low-privilege users from modifying restricted data.