CVE-2025-68535: 
WordPress vulnerability analysis and mitigation

CVE-2025-68535 is a Missing Authorization (Broken Access Control) vulnerability in the Sunshine Photo Cart WordPress plugin that allows attackers to exploit incorrectly configured access control security levels. It affects all versions of the plugin up to and including 3.5.7.1, with version 3.5.7.2 being the patched release. The vulnerability was reported on November 30, 2025, and published on December 24–30, 2025. The NVD assigns a CVSS v3.1 base score of 9.1 (Critical), while Patchstack rates it at CVSS 4.3 (Medium) with a low priority impact assessment, noting the discrepancy is due to CVSS not being ideally suited for WordPress plugin vulnerabilities (Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization), corresponding to OWASP Top 10 category A1: Broken Access Control. The flaw stems from the absence of proper authorization, authentication, or nonce token checks in one or more plugin functions, allowing a low-privileged user (at the Subscriber level) to execute actions that should require higher privileges. The attack vector is network-accessible, requires no user interaction, and has low attack complexity, making it straightforward to exploit against any internet-facing WordPress site running the affected plugin versions (Patchstack).

Successful exploitation could allow an unauthenticated or low-privileged attacker to access restricted resources or perform unauthorized actions within the Sunshine Photo Cart plugin, with high confidentiality and integrity impacts per the NVD CVSS scoring. This may include unauthorized access to sensitive customer or order data managed by the photo cart plugin, as well as potential manipulation of site content or plugin configurations. Availability is not directly impacted, but the compromise of customer data and site integrity could have significant downstream consequences for affected WordPress site operators (Patchstack).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.03%, indicating a very low probability of exploitation in the near term. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that while vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress plugins at scale, this specific issue is assessed as low priority and unlikely to be exploited in practice (Patchstack).

The vulnerability is patched in Sunshine Photo Cart version 3.5.7.2; all site operators running version 3.5.7.1 or earlier should update immediately. Patchstack users can enable auto-update for vulnerable plugins to receive the fix automatically. If an immediate update is not possible, site administrators should consider temporarily disabling the plugin, reviewing and restricting access controls, and monitoring for suspicious activity. A thorough security audit of the WordPress site is also recommended (Patchstack).

The vulnerability received brief coverage from automated security news aggregators including The Hacker Wire on social platforms (Mastodon, Bluesky) shortly after publication. No significant researcher commentary or vendor statements beyond the Patchstack advisory have been identified. Community sentiment appears muted, consistent with the low-priority classification assigned by Patchstack.