CVE-2025-68508: 
WordPress vulnerability analysis and mitigation

CVE-2025-68508 is a Missing Authorization (Broken Access Control) vulnerability in the Brave Popup Builder WordPress plugin that allows unauthenticated network attackers to exploit incorrectly configured access control security levels. It affects all versions of the plugin up to and including 0.8.3, with version 0.8.4 being the patched release. The vulnerability was reported on November 23, 2025, and published on December 23–24, 2025. It carries a CVSS v3.1 base score of 5.3 (Medium) (Patchstack).

The root cause is classified as CWE-862 (Missing Authorization), meaning one or more plugin functions lack proper authorization, authentication, or nonce token checks before executing privileged actions. This allows an unauthenticated remote attacker to invoke functionality that should be restricted to higher-privileged users (e.g., administrators). The attack vector is network-based, requires no privileges and no user interaction, and has low attack complexity. No public proof-of-concept exploit code has been identified at this time (Patchstack).

Successful exploitation results in a limited confidentiality impact, as unauthenticated attackers may access data or trigger actions that should require elevated privileges. Integrity and availability are not directly impacted according to the CVSS scoring (confidentiality: Low, integrity: None, availability: None). While the individual impact is low, Patchstack notes that vulnerabilities of this class are commonly used in mass-exploit campaigns targeting thousands of WordPress sites simultaneously, regardless of site size or popularity (Patchstack).

There is no known public proof-of-concept exploit and no evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.03%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack classifies this as low priority with no impactful threat currently observed (Patchstack).

The vendor has released version 0.8.4 of the Brave Popup Builder WordPress plugin, which resolves this vulnerability. Site administrators should update the plugin to version 0.8.4 or later immediately. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard. If an immediate update is not possible, site owners should consult their hosting provider or web developer, and consider restricting access to the WordPress admin area as a temporary measure (Patchstack).

The vulnerability was discovered and disclosed by security researcher "daroo" through Patchstack's vulnerability disclosure program, published on December 23, 2025. The Hacker Wire briefly covered the CVE on social media platforms including Mastodon and Bluesky. No significant broader industry commentary or vendor statements beyond the Patchstack advisory have been identified.