CVE-2025-68502: 
WordPress vulnerability analysis and mitigation

CVE-2025-68502 is an Insecure Direct Object Reference (IDOR) vulnerability in the Crocoblock JetPopup WordPress plugin that allows low-privileged authenticated users to bypass authorization controls and access restricted data. It affects JetPopup versions up to and including 2.0.20.1, with version 2.0.20.2 containing the fix. The vulnerability was reported on November 30, 2025, and publicly disclosed on December 30, 2025. It carries a CVSS v3.1 base score of 4.3 (Medium) (Patchstack, Red Hat CVE).

The vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), which maps to OWASP Top 10 A1: Broken Access Control. The flaw arises from the plugin's failure to properly validate that a requesting user is authorized to access specific objects referenced by user-controlled keys or identifiers, enabling an authenticated user with Contributor-level privileges or higher to reference and retrieve objects they should not have access to. No public proof-of-concept code or detailed technical write-up has been identified at this time (Patchstack).

Successful exploitation results in a confidentiality breach, allowing authenticated low-privileged users to access sensitive files, folders, or database content that should be restricted. Integrity and availability are not impacted according to the CVSS scoring. The scope is limited to the affected WordPress installation, but unauthorized data access could expose sensitive popup configurations, user data, or other restricted content managed by the plugin (Patchstack, Red Hat CVE).

No public exploit code or evidence of in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.025% (0.000250), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack classifies this as low priority and notes it is unlikely to be exploited, though they acknowledge that IDOR-class vulnerabilities can be used in mass-exploit campaigns targeting WordPress sites at scale (Patchstack).

The vendor Crocoblock has released a patched version of JetPopup (2.0.20.2) that resolves this vulnerability. Site administrators should update the JetPopup plugin to version 2.0.20.2 or later immediately. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard. If an immediate update is not possible, restricting Contributor-level user access or temporarily disabling the plugin is advisable (Patchstack).

The vulnerability was discovered and reported by security researcher "Bonds" through Patchstack's Active VDP program on November 30, 2025, and disclosed publicly on December 30, 2025. Patchstack characterized the issue as low priority with no impactful threat, noting it is unlikely to be exploited in practice. No significant broader media coverage or notable community discussion has been identified beyond standard vulnerability database aggregation (Patchstack).