CVE-2025-68980: 
WordPress vulnerability analysis and mitigation

CVE-2025-68980 is a Missing Authorization (Broken Access Control) vulnerability in the WeDesignTech Portfolio WordPress plugin by designthemes. It affects all versions up to and including 1.0.2 (patched in version 1.0.4), allowing attackers to exploit incorrectly configured access control security levels. The vulnerability was reported on November 18, 2025, by researcher Phat RiO and published on December 18–30, 2025. It carries a CVSS v3.1 base score of 8.1 (High) per NVD, though Patchstack assigns a score of 5.3 (Medium) with low priority impact (Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the plugin fails to perform adequate authorization checks before executing privileged actions. This allows a low-privileged (or potentially unauthenticated, per Patchstack's assessment) network-based attacker to invoke restricted functionality without proper permission validation. The flaw is network-exploitable with low attack complexity and requires no user interaction, making it straightforward to abuse. No public proof-of-concept code has been identified at this time (Patchstack).

Successful exploitation can result in high confidentiality and integrity impact — attackers can read sensitive data and modify portfolio content that should be restricted by proper access controls. Availability is not directly affected. The vulnerability could lead to unauthorized data disclosure, content tampering, and potential exposure of sensitive information stored within the WordPress installation (Patchstack).

There is currently no public proof-of-concept exploit and no evidence of in-the-wild exploitation. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress plugins at scale, regardless of site popularity (Patchstack).

The vendor has released version 1.0.4 of the WeDesignTech Portfolio plugin, which resolves this vulnerability. Site administrators should update immediately to version 1.0.4 or later via the WordPress plugin dashboard. If an immediate update is not possible, consider deactivating or removing the plugin, restricting user account privileges to the minimum necessary level, and deploying a Web Application Firewall (WAF) to monitor for unauthorized access attempts. Patchstack users can enable auto-update for vulnerable plugins to automate remediation (Patchstack).