CVE-2025-68058: 
WordPress vulnerability analysis and mitigation

CVE-2025-68058 is a Missing Authorization vulnerability in the e-plugins Institutions Directory WordPress plugin that allows authenticated attackers to exploit incorrectly configured access control security levels. It affects all versions of the Institutions Directory plugin through 1.3.4. The vulnerability was published on January 22, 2026, and was reported by Patchstack. It carries a CVSS v3.1 base score of 7.6 (High), as assigned by Patchstack (NVD, Patchstack).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether an authenticated user has the appropriate permissions before allowing access to certain functionality or data. The attack vector is network-based, requires low privileges (an authenticated user account), and has low attack complexity with no user interaction required. This class of vulnerability typically arises when WordPress plugin developers omit capability checks (e.g., current_user_can()) on AJAX handlers or REST API endpoints, allowing lower-privileged users to perform actions reserved for administrators (NVD, Patchstack).

Successful exploitation allows an authenticated attacker with low privileges to access sensitive data (high confidentiality impact), make unauthorized modifications to plugin data or settings (high integrity impact), and cause limited disruption to availability. The scope is limited to the affected WordPress installation, but the integrity impact is the primary concern — attackers could manipulate institution directory entries, potentially defacing content or injecting malicious data visible to site visitors (NVD).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum a low-privileged authenticated account on the target WordPress site, which limits opportunistic mass exploitation (NVD).

1. Reconnaissance: Identify WordPress sites running the Institutions Directory plugin (version ≤ 1.3.4) using tools like WPScan or by checking the plugin's readme.txt file at https://target.com/wp-content/plugins/institutions-directory/readme.txt.
2. Obtain low-privileged access: Register or obtain a low-privileged WordPress account (e.g., Subscriber role) on the target site.
3. Identify unprotected endpoints: Enumerate AJAX actions or REST API endpoints registered by the plugin that lack proper capability checks, typically by reviewing the plugin's source code or intercepting requests with a proxy tool like Burp Suite.
4. Send unauthorized request: Craft and send an authenticated HTTP request (with a valid nonce and session cookie) to the vulnerable endpoint, performing an action that should be restricted to administrators — such as modifying, adding, or deleting institution directory entries.
5. Achieve objective: Confirm unauthorized data modification or access, potentially defacing directory content or extracting sensitive institution data (NVD, Patchstack).

• Logs: WordPress access logs showing authenticated POST requests to wp-admin/admin-ajax.php or REST API endpoints associated with the institutions-directory plugin from low-privileged user accounts at unusual times or frequencies.
• Logs: WordPress debug logs or audit plugin logs recording capability-check failures or unexpected data modifications to institution directory entries.
• File System: Unexpected changes to institution directory data in the WordPress database (wp_posts or custom plugin tables) not attributable to administrative users.
• Network: Repeated authenticated requests to plugin-specific AJAX actions from the same low-privileged user account in a short time window.

Users should update the Institutions Directory plugin to a version beyond 1.3.4 if a patched release is available from the plugin developer (e-plugins). If no patch is yet available, site administrators should consider deactivating and removing the plugin until a fix is released. Access to the WordPress site should be restricted to trusted users, and the principle of least privilege should be enforced to limit the pool of accounts that could exploit this vulnerability. Monitoring WordPress audit logs for unauthorized access attempts is also recommended (NVD, Patchstack).