CVE-2025-68896: 
WordPress vulnerability analysis and mitigation

CVE-2025-68896 is a Missing Authorization vulnerability in the WDV One Page Docs WordPress plugin (by vendor vrpr) that allows unauthenticated remote attackers to exploit incorrectly configured access control security levels. All versions up to and including 1.2.4 are affected. The vulnerability was published on January 22, 2026, by Patchstack, with CVSS v3.1 scoring added by CISA-ADP on January 27, 2026. It carries a CVSS v3.1 base score of 6.5 (Medium) (NVD, Feedly).

The root cause is classified as CWE-862 (Missing Authorization) — the plugin fails to enforce proper capability or permission checks before allowing access to certain functionality, enabling attackers to bypass intended access controls. Because no authentication (PR:N) or user interaction (UI:N) is required and attack complexity is low, any network-accessible attacker can trigger the flaw. The vulnerability allows exploitation of incorrectly configured access control security levels, potentially enabling unauthorized modification or disruption of plugin-managed content. Patchstack is the credited discoverer and reporter (NVD).

Successful exploitation results in limited but meaningful integrity and availability impacts — an unauthenticated attacker can make unauthorized changes to plugin-managed documentation content (integrity impact: Low) and potentially disrupt its availability (availability impact: Low). Confidentiality is not directly impacted according to the CVSS assessment. The scope is limited to the affected WordPress installation, with no evidence of lateral movement potential beyond the plugin's functional boundary (NVD, Feedly).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-68896. The EPSS score is approximately 0.017%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Feedly).

Users should update the WDV One Page Docs WordPress plugin to a version beyond 1.2.4 if a patched release is available from the plugin author (vrpr). If no patched version is yet available, site administrators should consider deactivating and removing the plugin until a fix is released. Restricting access to WordPress admin and plugin endpoints via web application firewall (WAF) rules can serve as an interim mitigation (NVD, Patchstack).