CVE-2025-68072: 
WordPress vulnerability analysis and mitigation

CVE-2025-68072 is a Missing Authorization vulnerability in the Easy Property Listings WordPress plugin developed by Merv Barrett. It allows unauthenticated remote attackers to exploit incorrectly configured access control security levels. The vulnerability affects Easy Property Listings versions up to and including 3.5.20 (initially reported as ≤ 3.5.17, later updated to ≤ 3.5.20 by Patchstack on April 1, 2026). It was first published on January 22, 2026, and carries a CVSS v3.1 base score of 6.5 (Medium) (NVD, Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether a requesting user has the necessary permissions before performing sensitive operations. This allows network-based attackers with no authentication or special privileges to interact with restricted functionality — a classic broken access control scenario. The attack requires no user interaction and has low complexity, making it straightforward to exploit over the network. The specific plugin endpoint(s) lacking authorization checks have not been publicly detailed beyond the Patchstack advisory (NVD, Patchstack).

Successful exploitation results in limited but meaningful unauthorized access: attackers can achieve low-impact confidentiality breaches (e.g., reading restricted property listing data) and low-impact integrity violations (e.g., modifying or manipulating listing content) without authentication. Availability is not impacted. The scope is limited to the affected WordPress installation, but on sites where the plugin manages real estate listings with sensitive client or property data, unauthorized read/write access could expose business-sensitive information or allow content manipulation (NVD).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for CVE-2025-68072. The EPSS score is approximately 0.017%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (NVD, Patchstack).

Users should update the Easy Property Listings WordPress plugin to a version beyond 3.5.20, which is the last confirmed vulnerable release. Site administrators should check the WordPress plugin repository or the vendor's official page for the latest patched release and apply it immediately. As a temporary measure, consider disabling the plugin if an update is not immediately available, particularly on sites handling sensitive property or client data. Restricting access to the WordPress admin and REST API endpoints via firewall rules or security plugins (e.g., Wordfence) can reduce exposure (NVD, Patchstack).