CVE-2025-67976: 
WordPress vulnerability analysis and mitigation

CVE-2025-67976 is a Missing Authorization (Broken Access Control) vulnerability in the Watu Quiz WordPress plugin by Bob (kibokolabs). It allows authenticated attackers with low privileges to exploit incorrectly configured access control security levels, potentially gaining unauthorized access to sensitive data. The vulnerability affects Watu Quiz versions up to and including 3.4.5. It was published on December 16, 2025, and assigned a CVSS v3.1 base score of 6.5 (Medium) by CISA-ADP (NVD, Patchstack).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether a requesting user has the necessary permissions before granting access to certain functionality or data. The attack vector is network-based, requires low privileges (an authenticated user account), low attack complexity, and no user interaction. Exploitation involves sending crafted requests to plugin endpoints that lack proper capability checks, allowing a low-privileged user to access resources or perform actions beyond their intended authorization level (NVD, Patchstack).

Successful exploitation results in a high confidentiality impact with no integrity or availability impact, meaning an attacker can read sensitive information they should not have access to — such as quiz results, user data, or other restricted plugin content — but cannot modify or delete data. The scope is unchanged, limiting the impact to the affected WordPress installation. While lateral movement potential is low, exposure of quiz participant data or administrative information could have privacy and compliance implications (NVD).

Users should update the Watu Quiz WordPress plugin to a version beyond 3.4.5 that addresses this access control flaw. Check the WordPress plugin repository or the vendor's release notes for a patched version. As a temporary workaround, site administrators can restrict plugin access to trusted roles only or deactivate the plugin until a patch is applied. Regularly auditing WordPress plugin permissions and applying the principle of least privilege to user roles is also recommended (Patchstack, NVD).