CVE-2025-68521: 
WordPress vulnerability analysis and mitigation

CVE-2025-68521 is a Missing Authorization (Broken Access Control) vulnerability in the WpStream WordPress plugin that allows unauthenticated attackers to exploit incorrectly configured access control security levels. It affects WpStream versions up to and including 4.9.5, with version 4.9.6 serving as the patched release. The vulnerability was reported on November 29, 2025, by researcher Que Thanh Tuan and published on December 24–29, 2025. It carries a CVSS v3.1 base score of 5.3 (Medium) (Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the plugin fails to perform adequate authorization checks before executing certain privileged actions. An unauthenticated remote attacker can send crafted network requests to trigger functionality that should be restricted to higher-privileged users, exploiting incorrectly configured access control security levels. No user interaction is required, and attack complexity is low, making it straightforward to exploit over the network (Patchstack, Feedly).

Successful exploitation allows unauthenticated attackers to perform actions reserved for higher-privileged users, potentially leading to unauthorized modification of data and compromise of the WordPress site's integrity. The CVSS score reflects a low integrity impact with no confidentiality or availability impact in the base scoring, though real-world exploitation in mass-campaign scenarios could affect site content and configuration. Patchstack notes that vulnerabilities of this class are commonly used in mass-exploit campaigns targeting thousands of WordPress sites regardless of their size or popularity (Patchstack).

There is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.039%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack classifies this as low priority with no impactful threat currently observed (Patchstack, Feedly).

The primary remediation is to update the WpStream WordPress plugin to version 4.9.6 or later, which contains the fix for this vulnerability. If immediate patching is not possible, site administrators should audit current access controls and user permissions, implement strict role-based access control, and consider temporarily restricting plugin functionality. Patchstack users can enable auto-update for vulnerable plugins to automate remediation (Patchstack).

The vulnerability received brief coverage from TheHackerWire on social media platforms including Mastodon and Bluesky shortly after disclosure. Patchstack, which coordinated the disclosure, classified it as low priority with no impactful threat, tempering community concern. No significant vendor statements or notable researcher commentary beyond the initial Patchstack advisory have been identified (Patchstack).