CVE-2025-68515: 
WordPress vulnerability analysis and mitigation

CVE-2025-68515 is a Sensitive Data Exposure vulnerability (CWE-201: Insertion of Sensitive Information Into Sent Data) in the WP Booking System WordPress plugin developed by Roland Murg. It affects all versions up to and including 2.0.19.12, and was reported on December 5, 2025, with public disclosure on March 4–5, 2026. The vulnerability carries a CVSS v3.1 base score of 5.8 (Medium) and was assigned by Patchstack (Patchstack).

The root cause is classified as CWE-201 (Insertion of Sensitive Information Into Sent Data), meaning the plugin inadvertently includes sensitive data in responses or transmitted data that should not be accessible to unauthenticated users. The attack vector is network-based, requires no authentication, no user interaction, and low attack complexity, with a changed scope indicating the impact crosses a security boundary. The vulnerability enables attackers to retrieve embedded sensitive data from the plugin's responses, potentially exposing information that could be leveraged to exploit other weaknesses in the system (Patchstack).

Successful exploitation allows unauthenticated remote attackers to view sensitive information that is normally restricted from regular users, resulting in a low confidentiality impact with no integrity or availability impact. The changed scope suggests the exposed data may cross trust boundaries within the WordPress environment, potentially enabling attackers to use the disclosed information as a stepping stone for further attacks against the site or its users. While the individual impact is limited, this type of vulnerability is noted by Patchstack as being used in mass-exploit campaigns targeting thousands of WordPress sites regardless of their size or popularity (Patchstack).

No public proof-of-concept exploit code or confirmed in-the-wild exploitation has been reported for CVE-2025-68515. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack classifies this as low priority with unlikely exploitation, though the unauthenticated, network-accessible nature of the flaw means it could be incorporated into automated scanning campaigns (Patchstack).

The vulnerability is patched in WP Booking System version 2.0.19.13. Site administrators should update the plugin to version 2.0.19.13 or later immediately. If an immediate update is not possible, site owners should contact their hosting provider or web developer for assistance. Patchstack users can enable auto-update for vulnerable plugins to automate remediation (Patchstack).

Patchstack, which discovered and disclosed the vulnerability (credited to researcher benzdeus), classifies it as low priority with no significant immediate threat. No notable vendor statements beyond the Patchstack advisory or broader media coverage have been identified for this vulnerability.