CVE-2025-68021: 
WordPress vulnerability analysis and mitigation

CVE-2025-68021 is a Missing Authorization (Broken Access Control) vulnerability in the ConveyThis WordPress translation plugin. It affects all versions of the conveythis-translate plugin up to and including version 270.4, and was patched in version 270.5. The vulnerability was reported on November 18, 2025, and published on January 27, 2026. It carries a CVSS v3.1 base score of 6.5 (Medium) (Patchstack, Feedly).

The root cause is classified as CWE-862 (Missing Authorization), meaning one or more plugin functions fail to perform adequate authorization checks before executing privileged actions. This allows unauthenticated, remote attackers to exploit incorrectly configured access control security levels — a pattern consistent with missing nonce token or capability checks in WordPress plugin REST API endpoints or AJAX handlers. No authentication or user interaction is required, and the attack complexity is low (Patchstack, Feedly).

Successful exploitation allows unauthenticated remote attackers to access restricted functionality within the ConveyThis plugin, resulting in low confidentiality impact (potential exposure of plugin or site configuration data) and low availability impact. Integrity is not directly affected according to the CVSS scoring. While the individual impact per site is moderate, this class of vulnerability is commonly leveraged in mass-exploit campaigns targeting thousands of WordPress sites simultaneously, regardless of site size or traffic (Patchstack).

No public proof-of-concept exploit code has been identified at this time. The EPSS score is approximately 0.017%, indicating a low but non-negligible probability of exploitation in the near term (Feedly). Patchstack notes that broken access control vulnerabilities of this type are frequently used in mass-exploit campaigns against WordPress sites. There is no current evidence of active in-the-wild exploitation or CISA KEV catalog listing (Patchstack).

Update the ConveyThis plugin to version 270.5 or later, which contains the fix for this vulnerability. If an immediate update is not possible, site administrators should consult their hosting provider or web developer for assistance. Patchstack users benefit from a virtual patch (mitigation rule) that blocks exploitation attempts until the plugin is updated (Patchstack).

The vulnerability was discovered and reported by security researcher NumeX and published by Patchstack on January 27, 2026. Wordfence also referenced this vulnerability in their weekly WordPress vulnerability intelligence report for the period of January 26–February 1, 2026 (Wordfence). No broader media coverage or notable social media discussion has been identified.