CVE-2025-68578: 
WordPress vulnerability analysis and mitigation

CVE-2025-68578 is a Missing Authorization (Broken Access Control) vulnerability in the Addonify Quick View WordPress plugin. It allows unauthenticated or low-privileged network attackers to exploit incorrectly configured access control security levels, potentially modifying data without proper authorization. The vulnerability affects all versions of the Addonify Quick View plugin up to and including 2.0.4. It was published on December 24, 2025, and assigned a CVSS v3.1 base score of 5.3 (Medium) (Feedly, Patchstack).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether a requesting user has the necessary permissions before performing sensitive operations (Feedly). The attack vector is network-based, requires no authentication or user interaction, and has low attack complexity, making it accessible to unauthenticated or low-privileged attackers. The vulnerability stems from incorrectly configured access control security levels within the addonify-quick-view plugin component, allowing unauthorized requests to reach restricted functionality. No public proof-of-concept code has been identified at this time (Feedly).

Successful exploitation primarily affects integrity, allowing attackers to modify data or plugin settings without proper authorization; confidentiality and availability impacts are rated as none in the CVSS scoring (Feedly). In practice, unauthorized manipulation of plugin configuration or data could affect the behavior of the Quick View feature on WordPress storefronts, potentially enabling content tampering or unauthorized settings changes. The scope is limited to the affected WordPress installation and does not directly enable lateral movement or remote code execution based on currently available information.

There is no evidence of active in-the-wild exploitation or a publicly available proof-of-concept exploit for CVE-2025-68578 at this time (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.028% (0.000280), indicating a very low probability of exploitation in the near term. No threat actor attribution has been reported.

The primary remediation is to update the Addonify Quick View plugin to a version beyond 2.0.4, which addresses the missing authorization controls (Patchstack). Site administrators should also review and enforce strict access control mechanisms for all installed plugins, apply the principle of least privilege for plugin users, and monitor WordPress access logs for any unauthorized access attempts. If an immediate update is not possible, consider temporarily deactivating the plugin until a patched version can be applied.

The vulnerability was reported by Patchstack and received brief coverage from The Hacker Wire on social media platforms including Mastodon, Bluesky, and their website shortly after disclosure (Feedly). It was also included in a CISA weekly vulnerability summary for the week of December 22, 2025, published by Red Packet Security. No significant vendor statements or notable researcher commentary beyond the initial disclosure have been identified.