CVE-2025-68995: 
WordPress vulnerability analysis and mitigation

CVE-2025-68995 is a Missing Authorization (Broken Access Control) vulnerability in the Premio "My Sticky Elements" WordPress plugin, affecting versions up to and including 2.3.3. It allows authenticated attackers with low privileges (Subscriber-level) to exploit incorrectly configured access control security levels. The vulnerability was reported on November 25, 2025, and publicly disclosed on December 25–30, 2025. It carries a CVSS v3.1 base score of 4.3 (Medium) (Patchstack).

The root cause is classified as CWE-862 (Missing Authorization), where one or more plugin functions lack proper authorization, authentication, or nonce token checks before execution. This allows a low-privileged authenticated user (e.g., a Subscriber) to invoke actions that should be restricted to higher-privileged roles. The attack vector is network-based, requires low privileges, no user interaction, and has low attack complexity. No public proof-of-concept exploit code has been identified at this time (Patchstack).

Successful exploitation results in a limited availability impact, with no confidentiality or integrity impact according to the CVSS scoring. An attacker with a low-privileged WordPress account could perform unauthorized actions within the plugin's functionality, potentially disrupting plugin behavior or settings. The scope is unchanged, meaning exploitation is confined to the affected plugin and does not directly enable lateral movement or sensitive data exposure (Patchstack).

No active in-the-wild exploitation has been reported, and no exploit kits or weaponized code are publicly known. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. Patchstack classifies this as low priority with unlikely exploitation impact. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Patchstack).

The vulnerability is patched in My Sticky Elements version 2.3.4. Site administrators should update the plugin to version 2.3.4 or later immediately. If an immediate update is not possible, site owners should contact their hosting provider or web developer for assistance. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard (Patchstack).

The vulnerability was discovered and reported by security researcher "daroo" through Patchstack's vulnerability disclosure program on November 25, 2025. Patchstack assigned it a low priority rating, noting it is unlikely to be exploited for significant impact. No notable broader media coverage or significant community discussion has been identified beyond standard vulnerability database listings.