CVE-2025-68588: 
WordPress vulnerability analysis and mitigation

CVE-2025-68588 is a Missing Authorization vulnerability in the TS Poll WordPress plugin developed by Totalsoft. It allows low-privilege authenticated attackers to exploit incorrectly configured access control security levels, potentially bypassing intended restrictions. The vulnerability affects TS Poll versions up to and including 2.5.3 (per ENISA/Patchstack) or 2.5.5 (per NVD). It was disclosed on December 24, 2025, with a CVSS v3.1 base score of 4.3 (Medium) (Feedly, Patchstack).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether a requesting user has the necessary permissions before executing certain actions. The attack vector is network-based, requires low privileges (an authenticated user account), and has low attack complexity with no user interaction needed. This falls under the broader category of Broken Access Control, where insufficiently enforced permission checks allow lower-privileged users to perform actions reserved for higher-privileged roles (Feedly).

Successful exploitation allows a low-privilege authenticated attacker to bypass access controls within the TS Poll plugin, resulting in a limited integrity impact — such as unauthorized modification of poll data or plugin settings. There is no direct confidentiality or availability impact per the CVSS scoring. The scope is limited to the affected WordPress installation, with no evidence of lateral movement potential beyond the plugin's functionality (Feedly).

There is no public proof-of-concept exploit available, and no evidence of active in-the-wild exploitation has been observed as of the disclosure date. The EPSS score is approximately 0.028%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Feedly).

Users should immediately update the TS Poll WordPress plugin to a version beyond 2.5.5 (or the latest available patched release). Additionally, administrators should review and restrict user permissions within WordPress, audit plugin configurations for access control settings, and monitor WordPress logs for unauthorized access attempts targeting poll-related functionality. No specific configuration-based workaround has been published; updating the plugin is the primary remediation (Feedly, Patchstack).

The vulnerability was briefly noted on social media platforms including Mastodon and Bluesky by TheHackerWire shortly after disclosure on December 24, 2025. No significant vendor statements or in-depth researcher commentary have been published beyond the initial Patchstack advisory. Community reaction has been minimal, consistent with the medium severity rating and lack of active exploitation (Feedly).