CVE-2025-68534: 
WordPress vulnerability analysis and mitigation

CVE-2025-68534 is a Missing Authorization (Broken Access Control) vulnerability in the PDF for WPForms WordPress plugin by add-ons.org. It affects all versions up to and including 6.3.0, and was patched in version 6.3.1. The vulnerability was reported on November 29, 2025, and published by Patchstack on February 11, 2026. It carries a CVSS v3.1 base score of 6.5 (Medium) (Patchstack).

The root cause is classified as CWE-862 (Missing Authorization) — the plugin fails to properly verify whether a requesting user has the appropriate permissions before executing a privileged action. This allows a low-privileged authenticated user (at the Subscriber level) to exploit incorrectly configured access control security levels via a network-based attack with low complexity and no user interaction required. No technical write-up or public proof-of-concept code has been identified at this time (Patchstack).

Successful exploitation allows a low-privileged authenticated attacker (e.g., a Subscriber-level WordPress user) to perform unauthorized actions that should be restricted to higher-privileged roles, resulting in a high integrity impact. Confidentiality and availability are not directly affected according to the CVSS scoring. In a WordPress context, this type of broken access control can be leveraged in mass-exploit campaigns targeting thousands of sites regardless of their traffic or popularity (Patchstack).

No public proof-of-concept exploit or evidence of active in-the-wild exploitation has been confirmed at this time. The EPSS score is approximately 0.017%, indicating a low current probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack notes that vulnerabilities of this class are commonly used in mass-exploit campaigns against WordPress sites (Patchstack).

1. Reconnaissance: Identify WordPress sites running the PDF for WPForms plugin version ≤ 6.3.0 using tools like WPScan, Shodan, or by inspecting plugin metadata in publicly accessible WordPress installations.
2. Obtain low-privileged access: Register or obtain credentials for a Subscriber-level (or equivalent low-privilege) account on the target WordPress site.
3. Identify the unprotected endpoint: Locate the plugin function or REST API/admin-ajax endpoint that lacks proper authorization checks — this would be a function intended for higher-privileged users (e.g., administrators) but accessible without capability verification.
4. Send unauthorized request: Craft and submit an HTTP request to the vulnerable endpoint as the low-privileged user, bypassing the missing authorization check to trigger the privileged action (e.g., modifying PDF settings or form data).
5. Achieve integrity impact: The server processes the request without validating the user's role, allowing the attacker to perform unauthorized modifications to plugin data or configuration (Patchstack).

• Logs: WordPress access logs showing unexpected POST requests to plugin-related admin-ajax or REST API endpoints from Subscriber-level user accounts; repeated access to PDF for WPForms plugin endpoints outside of normal administrative activity.
• File System: Unexpected changes to plugin configuration files or PDF template settings within the wp-content/plugins/pdf-for-wpforms/ directory.
• Application: Unauthorized modifications to WPForms PDF settings or outputs not initiated by an administrator; new or altered PDF templates created by non-admin users.

The vendor has released version 6.3.1 of the PDF for WPForms plugin, which patches this vulnerability. Site administrators should update immediately via the WordPress plugin dashboard. Patchstack users benefit from a virtual patch (mitigation rule) that blocks exploitation attempts until the plugin is updated. If an immediate update is not possible, restricting user registration or limiting Subscriber-level account creation on the site can reduce the attack surface (Patchstack).