CVE-2025-68085: 
WordPress vulnerability analysis and mitigation

CVE-2025-68085 is a Missing Authorization vulnerability in the Buttoner for Elementor WordPress plugin developed by merkulove. It allows authenticated attackers with low privileges (Subscriber-level) to exploit incorrectly configured access control security levels, resulting in unauthorized settings changes. All versions up to and including 1.0.6 are affected, and no official patch was available at the time of disclosure. The vulnerability was reported by researcher Phat RiO on November 11, 2025, and published on December 16, 2025, with a CVSS v3.1 base score of 5.4 (Medium) (Patchstack).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether a requesting user has the necessary permissions before allowing access to sensitive plugin settings or administrative functions. An authenticated attacker with a low-privilege account (e.g., a Subscriber role on a WordPress site) can send crafted network requests to modify plugin settings without proper authorization checks. The attack requires no user interaction and has low complexity, making it straightforward to exploit once an attacker has any authenticated foothold on the target WordPress installation (Patchstack).

Successful exploitation allows a low-privileged authenticated attacker to make unauthorized changes to the Buttoner for Elementor plugin's settings, resulting in limited confidentiality and integrity impacts. While availability is not directly affected, unauthorized settings modifications could alter the appearance or behavior of button elements on the WordPress site, potentially enabling content manipulation or facilitating further attacks. The scope is limited to the affected WordPress instance and does not directly enable remote code execution or full site takeover (Patchstack).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for CVE-2025-68085. The EPSS score is very low at approximately 0.017%, indicating a minimal probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack classifies this as low priority, noting it is unlikely to be exploited despite the general risk that similar missing authorization flaws are used in mass-exploit campaigns targeting WordPress plugins (Patchstack).

At the time of disclosure, no official patched version of the Buttoner for Elementor plugin was available. Site administrators should monitor the WordPress plugin repository for an updated version that addresses this authorization flaw and apply it immediately upon release. As an interim measure, consider deactivating or removing the plugin if it is not critical to site operations, or restricting Subscriber-level user registrations to reduce the attack surface. Patchstack users may benefit from virtual patching protection while awaiting an official fix (Patchstack).

The vulnerability received limited industry attention, consistent with its medium severity and low exploitation probability. Patchstack, which discovered and disclosed the issue, classified it as low priority. Brief mentions appeared on automated CVE tracking platforms and social media feeds such as Bluesky, but no significant researcher commentary or media coverage was identified (Patchstack).