CVE-2025-68586: 
WordPress vulnerability analysis and mitigation

CVE-2025-68586 is a Missing Authorization vulnerability in the Gora Tech Cooked plugin for WordPress that allows unauthenticated attackers to exploit incorrectly configured access control security levels. It affects Cooked plugin versions up to and including 1.11.3 (with some sources citing 1.11.2 as the upper bound). The vulnerability was published on December 24, 2025, and assigned by Patchstack. It carries a CVSS v3.1 base score of 5.3 (Medium) (Feedly, Patchstack).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether a requesting user has the necessary permissions before granting access to certain functionality or resources. The attack vector is network-based, requires no authentication, no user interaction, and low attack complexity, making it trivially exploitable by any remote actor. The vulnerability stems from incorrectly configured access control security levels within the plugin's logic, allowing unauthorized requests to reach protected endpoints or operations (Feedly).

Successful exploitation allows an unauthenticated remote attacker to perform unauthorized actions that should be restricted by access controls, resulting in a low integrity impact (unauthorized data modification) with no confidentiality or availability impact per the CVSS scoring. While the CVSS score reflects a moderate impact, the lack of any authentication requirement means any internet-facing WordPress site running the affected plugin version is exposed. The practical risk is limited to integrity-related actions such as unauthorized content manipulation within the plugin's scope (Feedly).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is approximately 0.039%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

The primary remediation is to update the Cooked WordPress plugin to a version newer than 1.11.3 (or 1.11.2 per some sources). Site administrators should also conduct an access control audit, review and restrict user permissions, and monitor for any unauthorized access attempts. Implementing strict role-based access control (RBAC) and validating all access control mechanisms are recommended as complementary hardening steps (Feedly, Patchstack).

The vulnerability received brief social media coverage shortly after disclosure, with mentions on Mastodon and Bluesky via TheHackerWire accounts around December 25, 2025. It was also included in a Red Packet Security weekly CISA vulnerability summary for the week of December 22, 2025. No significant vendor statements or notable researcher commentary beyond the Patchstack disclosure have been observed (Feedly).