CVE-2025-67985: 
WordPress vulnerability analysis and mitigation

CVE-2025-67985 is an Authorization Bypass Through User-Controlled Key (IDOR) vulnerability in the Barn2 Plugins Document Library Lite WordPress plugin. It affects all versions from n/a through 1.1.7 and allows unauthenticated remote attackers to exploit incorrectly configured access control security levels. The vulnerability was reported by Patchstack and first published on December 16, 2025. It carries a CVSS v3.1 base score of 5.3 (Medium), assigned by Patchstack (Patchstack).

The vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), commonly known as an Insecure Direct Object Reference (IDOR). The plugin fails to properly validate or authorize user-supplied keys used to access document objects, allowing an attacker to manipulate these keys in requests to access resources they should not be permitted to view. No authentication or special privileges are required, and exploitation requires no user interaction. The attack vector is network-based with low complexity (Patchstack).

Successful exploitation allows an unauthenticated attacker to bypass access controls and read documents or resources that should be restricted, resulting in unauthorized disclosure of potentially sensitive information. The integrity and availability of the system are not directly affected by this vulnerability. The scope is limited to the affected WordPress installation, but depending on the sensitivity of documents stored in the library, the confidentiality impact could be significant for affected site owners (Patchstack).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been identified for this vulnerability. The EPSS score is approximately 0.017%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Feedly).

1. Reconnaissance: Identify WordPress sites running the Document Library Lite plugin (version ≤ 1.1.7) using tools like WPScan, Shodan, or by inspecting plugin directories on target sites.
2. Enumerate document objects: Send unauthenticated HTTP requests to the plugin's document access endpoints, manipulating object identifier parameters (e.g., document IDs or keys) to enumerate accessible resources.
3. Bypass access control: Substitute a valid but unauthorized document key or ID in the request to access restricted documents that the current user (or unauthenticated visitor) should not be able to view.
4. Exfiltrate data: Download or read the contents of restricted documents returned by the server, potentially exposing sensitive files stored in the document library (Patchstack).

• Network: Unusual or sequential HTTP GET/POST requests to document library endpoints with incrementing or enumerated object ID/key parameters from a single IP address.
• Logs: WordPress access logs showing repeated unauthenticated requests to document download or access URLs with varying document identifiers, particularly from non-authenticated sessions.
• Logs: HTTP 200 responses to document access requests from unauthenticated users for resources that should require authentication.

Site administrators should update the Document Library Lite plugin to a version beyond 1.1.7 that addresses this vulnerability. Until a patch is confirmed available, consider restricting access to document library endpoints via web application firewall (WAF) rules or by requiring authentication for all document access. Monitoring access logs for anomalous enumeration patterns is also recommended as a detective control (Patchstack).