CVE-2025-68007: 
WordPress vulnerability analysis and mitigation

CVE-2025-68007 is a Missing Authorization vulnerability in the Event Espresso 4 Decaf WordPress plugin that allows unauthenticated attackers to exploit incorrectly configured access control security levels, resulting in unauthorized settings changes. It affects all versions of Event Espresso 4 Decaf up to and including 5.0.37.decaf. The vulnerability was reported by researcher Legion Hunter on October 22, 2025, and publicly disclosed by Patchstack on January 15, 2026. It carries a CVSS v3.1 base score of 6.5 (Medium), assigned by Patchstack (Patchstack).

The root cause is CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether a requesting user has the necessary permissions before allowing access to sensitive settings-modification functionality. This falls under OWASP Top 10 category A1: Broken Access Control. Because no authentication or privilege check is enforced, a remote, unauthenticated attacker can send crafted HTTP requests to the vulnerable plugin endpoints to alter plugin or site settings (Patchstack).

Successful exploitation allows an unauthenticated remote attacker to modify plugin settings on affected WordPress sites running Event Espresso 4 Decaf. This can result in integrity impacts such as altering event registration configurations, payment settings, or other plugin-controlled options, as well as limited availability impacts. While confidentiality impact is not directly indicated in the final Patchstack CVSS vector, unauthorized settings changes could facilitate further attacks or disrupt event management operations (Patchstack).

No public proof-of-concept exploit code or confirmed in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.017% (0.000170), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack notes that vulnerabilities of this class are commonly used in mass-exploit campaigns targeting WordPress plugins at scale, regardless of site popularity (Patchstack).

1. Reconnaissance: Identify WordPress sites running the Event Espresso 4 Decaf plugin at version 5.0.37.decaf or earlier using tools like WPScan, Shodan, or Google dorks targeting plugin-specific paths (e.g., /wp-content/plugins/event-espresso-decaf/).
2. Identify vulnerable endpoint: Locate the plugin's settings-modification endpoint or REST API route that lacks proper authorization checks.
3. Craft unauthenticated request: Send a crafted HTTP POST (or GET) request to the vulnerable endpoint without any authentication credentials or nonce, including the desired settings values as parameters.
4. Modify settings: The server processes the request without verifying user permissions, applying the attacker-supplied settings changes to the plugin configuration.
5. Achieve objective: Depending on the settings modified, the attacker may redirect payments, disable event registration, alter notification emails, or set up conditions for further exploitation (Patchstack).

• Network: Unexpected unauthenticated HTTP POST requests to Event Espresso 4 Decaf plugin endpoints (e.g., paths under /wp-admin/admin-ajax.php or plugin-specific REST API routes) from unknown or automated IP addresses.
• Logs: WordPress access logs showing repeated requests to plugin settings endpoints without valid authentication cookies or nonces; unusual activity in wp-admin logs from unauthenticated sessions.
• Application: Unexpected changes to Event Espresso plugin settings (e.g., payment gateway configuration, registration options, notification email addresses) without corresponding admin activity in WordPress audit logs.

The vulnerability is patched in Event Espresso 4 Decaf version 5.0.53.decaf. Site administrators should update the plugin to version 5.0.53.decaf or later immediately. Patchstack users benefit from a virtual patching/mitigation rule that blocks exploitation attempts until the plugin is updated. If immediate updating is not possible, consider temporarily deactivating the plugin or restricting access to WordPress plugin endpoints via web application firewall (WAF) rules (Patchstack).

Wordfence included this vulnerability in their weekly WordPress vulnerability report covering January 12–18, 2026, highlighting it as part of broader plugin security tracking (Wordfence Blog). No significant additional vendor statements or notable researcher commentary beyond the Patchstack disclosure have been identified.