CVE-2025-68498: 
WordPress vulnerability analysis and mitigation

CVE-2025-68498 is a Missing Authorization (Broken Access Control) vulnerability in the Crocoblock JetTabs WordPress plugin that allows authenticated low-privileged users to access sensitive data by exploiting incorrectly configured access control security levels. It affects JetTabs versions up to and including 2.2.12, with version 2.2.12.1 being the patched release. The vulnerability was reported on November 30, 2025, and publicly disclosed on December 30, 2025. It carries a CVSS v3.1 base score of 6.5 (Medium), assigned by Patchstack (Patchstack).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether a requesting user has the necessary permissions before executing certain privileged functions. Specifically, the vulnerability stems from a missing authorization, authentication, or nonce token check in a plugin function, allowing a user with Contributor-level or higher privileges to invoke actions beyond their intended access scope. No user interaction is required, and the attack is conducted entirely over the network with low complexity (Patchstack). The vulnerability maps to OWASP Top 10 category A1: Broken Access Control.

Successful exploitation results in a high confidentiality impact, allowing authenticated low-privileged attackers to read sensitive data they should not have access to. Integrity and availability are not affected by this vulnerability. While the scope is limited to the affected WordPress installation, exposure of sensitive site data could facilitate further attacks or information gathering against the target environment (Patchstack).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.028% (0.000280), indicating a very low probability of exploitation in the near term. Patchstack classifies this as low priority with no impactful threat currently observed, though they note that vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress plugins at scale (Patchstack). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

The vendor Crocoblock has released a patched version of JetTabs (2.2.12.1) that resolves this vulnerability. Site administrators should update the JetTabs plugin to version 2.2.12.1 or later immediately. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard. If an immediate update is not possible, restricting Contributor-level user registrations or limiting access to the WordPress admin area can reduce exposure (Patchstack).

The vulnerability was discovered and reported by a researcher credited as "Bonds" through Patchstack's Active Vulnerability Disclosure Program (VDP) on November 30, 2025, and published on December 30, 2025. Patchstack characterized the issue as low priority with unlikely exploitation impact. No significant broader media coverage or notable researcher commentary beyond the initial disclosure has been identified (Patchstack).