CVE-2025-68911: 
WordPress vulnerability analysis and mitigation

CVE-2025-68911 is a Missing Authorization (Broken Access Control) vulnerability in the Solace WordPress theme by solacewp, affecting all versions up to and including 2.1.16. It was reported by security researcher Denver Jackson on September 16, 2025, and published by Patchstack on January 13, 2026, with the CVE formally received by NVD on January 22, 2026. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium), assigned by Patchstack (Patchstack, NVD).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the theme fails to properly verify whether a requesting user has the necessary permissions before executing a privileged action. A low-privileged authenticated user (e.g., a Subscriber-level WordPress account) can exploit incorrectly configured access control security levels to perform actions beyond their intended privilege scope. The flaw is network-accessible, requires no user interaction, and has low attack complexity, making it straightforward to exploit once an attacker has any valid WordPress account (Patchstack, NVD).

Successful exploitation allows a low-privileged authenticated attacker to perform unauthorized actions on the affected WordPress site, with the primary impact being a high integrity impact — meaning an attacker can modify data or site configuration beyond their authorized scope. The confidentiality and availability impacts are rated as none per the final Patchstack CVSS scoring. In a WordPress context, this type of broken access control can enable attackers to alter theme settings, content, or other site data, potentially defacing the site or enabling further compromise (Patchstack, NVD).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.017%, indicating a low probability of exploitation in the near term. Patchstack notes that vulnerabilities of this class are commonly used in mass-exploit campaigns targeting thousands of WordPress sites regardless of traffic or popularity, suggesting elevated risk for unpatched installations. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Patchstack, NVD).

1. Reconnaissance: Identify WordPress sites using the Solace theme version 2.1.16 or earlier, using tools such as WPScan or by inspecting theme metadata in publicly accessible WordPress installations.
2. Obtain low-privileged access: Register or obtain credentials for a Subscriber-level (or equivalent low-privilege) WordPress account on the target site.
3. Identify unprotected endpoint: Locate the theme function or AJAX action that lacks proper authorization/nonce checks — this would be a function callable by any authenticated user that should be restricted to higher-privileged roles (e.g., Administrator or Editor).
4. Send crafted request: Issue a direct HTTP request (e.g., via admin-ajax.php or a REST API endpoint) to invoke the unprotected function, bypassing the intended access control.
5. Achieve unauthorized action: Successfully execute the privileged operation (such as modifying theme settings or site content) without the required permissions (Patchstack).

• Logs: WordPress access logs showing authenticated low-privileged users (Subscriber role) making POST requests to wp-admin/admin-ajax.php or REST API endpoints associated with theme configuration actions outside normal user behavior.
• Logs: Unexpected modifications to theme settings or site content recorded in WordPress audit logs, particularly attributed to Subscriber-level accounts.
• File System: Unexplained changes to theme configuration files or WordPress options table entries (wp_options) not initiated by an administrator.
• Network: Repeated or scripted requests from a single IP to WordPress AJAX or REST endpoints with theme-specific action parameters, potentially indicating automated exploitation attempts.

The vulnerability is patched in Solace theme version 2.1.17. Site administrators should update the Solace theme to version 2.1.17 or later immediately. As an interim measure, Patchstack offers a virtual patching/mitigation rule for subscribers that blocks exploitation attempts until the theme can be updated. If neither option is immediately available, restricting new user registrations or limiting Subscriber-level account creation can reduce the attack surface (Patchstack).