CVE-2025-68522: 
WordPress vulnerability analysis and mitigation

CVE-2025-68522 is a Missing Authorization (Broken Access Control) vulnerability in the WpStream WordPress plugin that allows low-privileged authenticated attackers to exploit incorrectly configured access control security levels. It affects WpStream versions up to and including 4.9.5, with version 4.9.6 serving as the patched release. The vulnerability was reported on November 30, 2025, by researcher Que Thanh Tuan and published on December 30, 2025. It carries a CVSS v3.1 base score of 4.3 (Medium) (Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the plugin fails to perform adequate authorization checks before executing certain privileged actions. A subscriber-level (low-privileged) authenticated user can invoke functions that should be restricted to higher-privileged roles, exploiting incorrectly configured access control security levels. The attack vector is network-based, requires low privileges, low complexity, and no user interaction, making it straightforward to exploit for any authenticated WordPress user (Patchstack).

Successful exploitation allows a low-privileged authenticated attacker (e.g., a subscriber) to access sensitive information or perform actions beyond their intended authorization level within the WordPress installation. The CVSS score reflects a limited confidentiality impact with no direct integrity or availability impact; however, the broader context of broken access control in WordPress plugins can facilitate unauthorized data exposure or configuration changes depending on the specific unprotected functions. Patchstack notes that vulnerabilities of this class are commonly used in mass-exploit campaigns targeting thousands of WordPress sites regardless of their size or popularity (Patchstack).

There is no public proof-of-concept exploit available, and no evidence of active in-the-wild exploitation has been observed as of the time of publication (Feedly). The EPSS score is approximately 0.039%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum a subscriber-level account on the target WordPress site, which limits opportunistic mass exploitation but does not eliminate risk in environments with open user registration (Patchstack).

The vendor has released WpStream version 4.9.6, which patches this vulnerability. Site administrators should update the WpStream plugin to version 4.9.6 or later immediately. If an immediate update is not possible, consider temporarily disabling the plugin and reviewing WordPress user roles to limit subscriber-level registrations. Patchstack users can enable auto-update for vulnerable plugins to automate remediation (Patchstack).

The vulnerability received brief social media coverage from TheHackerWire on Mastodon, Bluesky, and Infosec.Exchange shortly after disclosure, consistent with routine WordPress plugin vulnerability reporting. Patchstack, which coordinated the disclosure, classifies this as low priority with no impactful threat, and the broader security community has not raised significant concern given the limited CVSS score and absence of public exploits (Patchstack).