CVE-2025-68603: 
WordPress vulnerability analysis and mitigation

CVE-2025-68603 is a Missing Authorization (Broken Access Control) vulnerability in the Marketing Fire Editorial Calendar WordPress plugin, affecting all versions up to and including 3.8.8. It allows low-privileged authenticated attackers to exploit incorrectly configured access control security levels, potentially gaining unauthorized access to sensitive data and performing unauthorized modifications. The vulnerability was reported by Doan Dinh Van on November 20, 2025, and publicly disclosed on December 20–24, 2025. The CVSS v3.1 base score is 8.1 (High) per NVD, while Patchstack assigns a score of 5.4 (Medium) using their WordPress-specific scoring methodology (Patchstack, Red Hat CVE).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning one or more plugin functions fail to perform adequate authorization checks before executing privileged actions. A low-privileged user (Contributor or Developer role) can invoke these functions over the network without requiring user interaction, bypassing intended access control restrictions. The flaw falls under OWASP Top 10 category A1: Broken Access Control, and is consistent with missing nonce token or capability checks common in WordPress plugin vulnerabilities (Patchstack).

Successful exploitation allows a low-privileged authenticated attacker to access high-sensitivity information and modify critical data within the WordPress environment, resulting in high confidentiality and integrity impact with no availability impact. The attack is network-based and requires no user interaction, making it straightforward to execute. While the scope is limited to the affected WordPress instance, unauthorized data access and content manipulation could have significant consequences for site owners and their users (Red Hat CVE, Patchstack).

There is no public proof-of-concept exploit available, and no evidence of active in-the-wild exploitation has been observed as of the disclosure date. The EPSS score is approximately 0.028%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack rates the priority as Low, noting the security issue is unlikely to be exploited despite the class of vulnerability being used in mass-exploit campaigns targeting WordPress plugins (Patchstack).

The vendor has released version 3.8.9 of the Editorial Calendar plugin, which patches this vulnerability. Site administrators should update the plugin to version 3.8.9 or later immediately via the WordPress admin dashboard or their hosting provider. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard. As a complementary measure, administrators should review user roles and restrict Contributor/Developer access where not required, and audit WordPress plugin configurations for any signs of unauthorized access (Patchstack).

The vulnerability was reported through Patchstack's vulnerability disclosure program by researcher Doan Dinh Van and received limited broader media attention. Brief mentions appeared on social platforms including Mastodon and Bluesky via The Hacker Wire, consistent with routine WordPress plugin vulnerability disclosures. No significant vendor statements or notable researcher commentary beyond the Patchstack advisory have been identified (Patchstack).