CVE-2025-68568: 
WordPress vulnerability analysis and mitigation

CVE-2025-68568 is a Missing Authorization vulnerability in the Claspo WordPress plugin (also known as "Popup Builder: Exit-Intent pop-up, Spin the Wheel, Newsletter signup, Email Capture & Lead Generation forms maker"). It allows unauthenticated remote attackers to exploit incorrectly configured access control security levels. The vulnerability affects all versions of the plugin through 1.0.7 (NVD) / 1.0.5 (ENISA/Patchstack). It was published on December 24, 2025, and carries a CVSS v3.1 base score of 5.3 (Medium) (Feedly, Patchstack).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify that a requesting user has the necessary permissions before performing sensitive operations. The attack vector is network-based, requires no authentication, no user interaction, and low attack complexity, making it trivially exploitable by any remote actor. The flaw relates to incorrectly configured access control security levels on one or more plugin endpoints or AJAX actions, consistent with a Broken Access Control pattern common in WordPress plugins (Feedly, Patchstack).

Successful exploitation results in a low-integrity impact with no confidentiality or availability impact, meaning an unauthenticated attacker can perform unauthorized data modifications or trigger restricted plugin actions without proper credentials. The scope is limited to the affected WordPress installation, and there is no evidence of lateral movement potential or significant data exposure risk. The practical consequence is unauthorized manipulation of popup/widget configurations or plugin settings managed by the Claspo plugin (Feedly).

Users should update the Claspo WordPress plugin to a version beyond 1.0.7 (per NVD) or 1.0.5 (per Patchstack) as soon as a patched release is available from the plugin vendor. In the interim, site administrators can deactivate or remove the plugin to eliminate the attack surface. Monitoring WordPress admin logs for unexpected changes to popup or widget configurations may help detect unauthorized access attempts (Patchstack).

The vulnerability received brief coverage from security news aggregators including TheHackerWire on Mastodon and Bluesky shortly after disclosure, and was included in a CISA vulnerability summary for the week of December 22, 2025, compiled by Red Packet Security. No significant vendor statements or in-depth researcher commentary have been identified beyond the Patchstack disclosure (Feedly).