CVE-2025-68000: 
WordPress vulnerability analysis and mitigation

CVE-2025-68000 is a Missing Authorization (Broken Access Control) vulnerability in the PickPlugins Testimonial Slider WordPress plugin. It affects all versions up to and including 2.0.15, allowing low-privileged authenticated users (Subscriber-level) to perform actions beyond their intended access level. The vulnerability was reported on September 5, 2025, by researcher Abu Hurayra and published on December 25, 2025. It carries a CVSS v3.1 base score of 6.5 (Medium) (Patchstack, Feedly).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether a requesting user has the appropriate permissions before executing privileged operations. An authenticated attacker with Subscriber-level access can exploit incorrectly configured access control security levels to trigger higher-privileged actions within the plugin. The attack vector is network-based, requires low privileges, no user interaction, and low attack complexity, making it straightforward to exploit once authenticated (Patchstack, Feedly).

Successful exploitation primarily affects integrity — an attacker with a low-privileged WordPress account (e.g., Subscriber) can perform unauthorized administrative actions related to the Testimonial Slider plugin, such as modifying or deleting testimonial content. There is no direct confidentiality or availability impact based on the CVSS scoring. In a shared or multi-tenant WordPress environment, this could allow malicious registered users to tamper with site content managed by the plugin (Patchstack, Feedly).

No public proof-of-concept exploit code has been identified at this time. The EPSS score is approximately 0.017%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack notes that broken access control vulnerabilities of this type are commonly used in mass-exploit campaigns targeting WordPress sites at scale, regardless of site popularity (Patchstack, Feedly).

1. Reconnaissance: Identify WordPress sites running the Testimonial Slider plugin version 2.0.15 or earlier using tools like WPScan or Shodan with WordPress fingerprinting.
2. Authentication: Register or obtain a low-privileged account (Subscriber level) on the target WordPress site.
3. Identify vulnerable endpoint: Locate the plugin's AJAX actions or admin-facing endpoints that lack proper capability checks (e.g., missing current_user_can() or nonce verification).
4. Craft malicious request: Send a crafted HTTP POST request directly to the vulnerable endpoint (e.g., wp-admin/admin-ajax.php with the appropriate action parameter) while authenticated as a Subscriber.
5. Execute privileged action: The missing authorization check allows the request to succeed, enabling the attacker to modify, delete, or otherwise manipulate testimonial data beyond their intended privilege level (Patchstack).

• Logs: WordPress access logs showing POST requests to wp-admin/admin-ajax.php from Subscriber-level user accounts performing plugin-specific actions (e.g., testimonial modification or deletion) outside normal usage patterns.
• Logs: Unexpected changes to testimonial content in the WordPress database (wp_posts or plugin-specific tables) attributed to low-privileged user accounts.
• Network: Repeated or automated POST requests to WordPress AJAX endpoints from the same IP address, particularly targeting Testimonial Slider plugin actions.
• File System: Unexpected modifications to plugin configuration or data files in wp-content/plugins/testimonial/ directory.

As of the vulnerability's publication date (December 25, 2025), no official patch from PickPlugins was available for the Testimonial Slider plugin. Patchstack has issued a virtual patch (mitigation rule) to block exploitation attempts for users of its service. Site administrators should consider deactivating and removing the plugin until an official fix is released, restricting user registration if not needed, or deploying a web application firewall with WordPress-specific rules. Monitor the WordPress plugin repository for an updated version beyond 2.0.15 (Patchstack).

The vulnerability was discovered and reported by security researcher Abu Hurayra through Patchstack's coordinated disclosure process. Patchstack classified it as medium priority and noted the risk of mass-exploit campaigns targeting WordPress plugins with broken access control issues. No significant broader media coverage or notable social media discussion has been identified beyond the Patchstack advisory (Patchstack).