CVE-2025-68050: 
WordPress vulnerability analysis and mitigation

CVE-2025-68050 is a Missing Authorization (Broken Access Control) vulnerability in the Leadpages WordPress plugin that allows unauthenticated network-based attackers to exploit incorrectly configured access control security levels. It affects all versions of the Leadpages plugin up to and including version 1.1.3. The vulnerability was published on February 20, 2026, and carries a CVSS v3.1 base score of 6.5 (Medium) (Feedly).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether a requesting user has the necessary permissions before performing sensitive operations. The attack vector is network-based, requires no authentication (no privileges required), no user interaction, and has low attack complexity, making it straightforward to exploit remotely. The flaw falls under the broader category of Broken Access Control, where REST API endpoints or AJAX actions exposed by the plugin do not enforce appropriate capability checks before executing privileged functionality (Feedly, Wordfence).

Successful exploitation results in limited but meaningful impacts to both integrity and availability, with no confidentiality impact. An unauthenticated attacker could make unauthorized modifications to plugin-controlled data or settings (low integrity impact) and cause minor disruption to plugin functionality (low availability impact). The scope is unchanged, meaning exploitation is confined to the affected plugin's context and does not directly enable lateral movement to the broader WordPress installation or host system (Feedly).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported for CVE-2025-68050. The EPSS score is approximately 0.017%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been identified (Feedly).

Users should update the Leadpages WordPress plugin to a version beyond 1.1.3 that includes the authorization fix. Until a patched version is available or applied, site administrators can mitigate risk by disabling the Leadpages plugin entirely or restricting access to the WordPress site's REST API and AJAX endpoints via firewall rules or a Web Application Firewall (WAF). Monitoring plugin activity logs for unexpected or unauthorized requests to Leadpages-related endpoints is also advisable (Feedly, Wordfence).

Wordfence included CVE-2025-68050 in their weekly WordPress vulnerability report covering January 26 to February 1, 2026, as part of routine community disclosure tracking (Wordfence). No significant vendor statements, notable researcher commentary, or broader media coverage has been identified beyond standard vulnerability database listings.