CVE-2025-68040: 
WordPress vulnerability analysis and mitigation

CVE-2025-68040 is a Sensitive Data Exposure vulnerability (CWE-201: Insertion of Sensitive Information Into Sent Data) in the weDevs WP Project Manager WordPress plugin. It affects all versions through 3.0.1 and was published on December 29, 2025, with the patched version (3.0.2) released shortly after. The vulnerability was discovered by researcher MD ISMAIL and reported to Patchstack on September 10, 2025. It carries a CVSS v3.1 base score of 6.5 (Medium), assigned by Patchstack (Patchstack, Red Hat CVE).

The vulnerability is classified as CWE-201 (Insertion of Sensitive Information Into Sent Data), meaning the plugin inadvertently includes sensitive data in API responses or other outbound data that should not be accessible to lower-privileged users. Exploitation requires only a low-privilege authenticated account (e.g., a Subscriber-level WordPress user), with no user interaction required and low attack complexity over a network vector. The flaw maps to OWASP Top 10 category A3: Sensitive Data Exposure, and the attack pattern allows retrieval of embedded sensitive data that is normally restricted (Patchstack).

Successful exploitation results in a high confidentiality impact — authenticated attackers with minimal privileges can retrieve sensitive application data that should be restricted to higher-privileged roles. There is no integrity or availability impact. The exposed data could potentially be leveraged to facilitate further attacks, such as privilege escalation or targeted phishing, depending on the nature of the information disclosed (Patchstack, Red Hat CVE).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for CVE-2025-68040. The EPSS score is approximately 0.031% (0.000310), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this CVSS class are sometimes used in mass-exploit campaigns targeting WordPress plugins at scale, regardless of site popularity (Patchstack).

1. Reconnaissance: Identify WordPress sites running the WP Project Manager plugin (wedevs-project-manager) version 3.0.1 or earlier using tools like WPScan or Shodan queries targeting plugin-specific file paths.
2. Obtain low-privilege access: Register or obtain a Subscriber-level (or equivalent low-privilege) account on the target WordPress site, as the vulnerability requires authentication.
3. Probe API endpoints: Authenticate and send crafted HTTP requests to the plugin's REST API or AJAX endpoints that return project management data, looking for responses that include sensitive fields not intended for the authenticated user's role.
4. Extract sensitive data: Parse the API responses to retrieve embedded sensitive information (e.g., internal project details, user data, or configuration values) that should be restricted to higher-privileged roles.
5. Leverage disclosed data: Use the retrieved sensitive information to facilitate further attacks, such as privilege escalation, targeted social engineering, or exploitation of other vulnerabilities (Patchstack).

• Network: Unusual or repeated authenticated REST API or AJAX requests to WP Project Manager plugin endpoints (e.g., /wp-json/pm/v2/ routes) from low-privilege user accounts, particularly if accessing project or user data outside normal usage patterns.
• Logs: WordPress access logs showing Subscriber-level users making frequent GET requests to project management API endpoints; unexpected access to endpoints returning large data payloads.
• File System: No specific file-system artifacts expected for this information disclosure vulnerability, as exploitation is purely network-based.
• Process/Behavior: Anomalous user account activity — low-privilege accounts querying administrative or cross-project data endpoints at unusual hours or frequencies.

The vendor weDevs released version 3.0.2 of the WP Project Manager plugin to address this vulnerability; all users should update immediately from the WordPress plugin repository. Patchstack has also issued a virtual patch (mitigation rule) for Patchstack-protected sites, blocking exploitation attempts until the plugin is updated. If an immediate update is not possible, site administrators should restrict new user registrations or limit Subscriber-level account creation to reduce the attack surface (Patchstack).

The vulnerability received routine coverage across vulnerability tracking platforms including Vulners, VulDB, and CIRCL's vulnerability lookup service shortly after disclosure. No notable researcher commentary, vendor statements beyond the Patchstack advisory, or significant media coverage has been identified for this medium-severity vulnerability (Patchstack).