CVE-2025-68020: 
WordPress vulnerability analysis and mitigation

CVE-2025-68020 is a Missing Authorization (Broken Access Control) vulnerability in the WANotifier "Notifier" WordPress plugin that allows unauthenticated attackers to exploit incorrectly configured access control security levels. It affects all versions of the plugin through 2.7.13, with version 3.0.0 being the first patched release. The vulnerability was reported on November 6, 2025, and publicly disclosed by Patchstack on January 20–22, 2026. It carries a CVSS v3.1 base score of 6.5 (Medium), assigned by Patchstack (Patchstack, NVD).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning one or more plugin functions fail to perform adequate authorization checks before executing privileged actions (NVD). This is a classic Broken Access Control issue (OWASP Top 10: A1) where an unauthenticated or low-privileged user can invoke functionality intended for higher-privileged roles due to absent or improperly implemented nonce/capability checks (Patchstack). The attack vector is network-based, requires no authentication, no user interaction, and low attack complexity, making it straightforward to exploit remotely. The vulnerability was discovered by security researcher "Legion Hunter" (Patchstack).

Successful exploitation allows unauthenticated attackers to perform unauthorized actions within the WANotifier plugin, resulting in limited integrity and availability impacts on the affected WordPress site. According to the updated Patchstack CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L), confidentiality is not directly impacted, but attackers may be able to modify plugin data or disrupt plugin functionality (NVD, Patchstack). Patchstack notes that vulnerabilities of this class are commonly used in mass-exploit campaigns targeting thousands of WordPress sites regardless of their traffic or popularity (Patchstack).

No public proof-of-concept exploit code or confirmed in-the-wild exploitation has been reported for CVE-2025-68020 at this time. The EPSS score is very low at approximately 0.017%, indicating a currently low probability of exploitation in the near term (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack has issued a virtual patch/mitigation rule for its users to block exploitation attempts until the plugin is updated (Patchstack).

1. Reconnaissance: Identify WordPress sites running the WANotifier "Notifier" plugin at version 2.7.13 or earlier using tools like WPScan, Shodan, or by checking publicly accessible readme.txt files at /wp-content/plugins/notifier/readme.txt.
2. Identify unprotected endpoint: Enumerate plugin AJAX actions or REST API endpoints registered by the Notifier plugin that lack proper capability or nonce checks — these are the targets for unauthorized access.
3. Craft unauthenticated request: Send an HTTP POST or GET request directly to the vulnerable endpoint (e.g., via wp-admin/admin-ajax.php?action=<vulnerable_action>) without any authentication cookies or nonce tokens.
4. Execute unauthorized action: The missing authorization check allows the request to proceed, enabling the attacker to trigger privileged plugin functionality such as modifying plugin settings, sending notifications, or disrupting plugin operations.
5. Achieve objective: Depending on the specific unprotected function, the attacker may alter WhatsApp notification configurations, inject malicious content into notifications, or degrade plugin availability (Patchstack, NVD).

• Network: Unusual unauthenticated POST requests to wp-admin/admin-ajax.php with action parameters associated with the WANotifier/Notifier plugin; repeated requests from a single IP to plugin-specific endpoints.
• Logs: WordPress access logs showing requests to plugin AJAX handlers without valid authentication sessions or nonce tokens; HTTP 200 responses to requests that should require authentication.
• File System: Unexpected changes to WANotifier plugin configuration files or database entries related to notification settings.
• Application: Unexpected WhatsApp notifications being sent from the site; plugin settings modified without corresponding administrator activity in WordPress audit logs.

The primary remediation is to update the WANotifier "Notifier" plugin to version 3.0.0 or later, which contains the fix for this vulnerability (Patchstack). Site administrators unable to update immediately should contact their hosting provider or web developer for assistance. Patchstack users benefit from an automatically deployed virtual patch/mitigation rule that blocks exploitation attempts until the plugin is updated (Patchstack). As a general hardening measure, restrict access to WordPress admin AJAX endpoints via firewall rules where feasible.