CVE-2025-68997: 
WordPress vulnerability analysis and mitigation

CVE-2025-68997 is an Insecure Direct Object Reference (IDOR) / Authorization Bypass Through User-Controlled Key vulnerability in the wpDiscuz WordPress plugin by AdvancedCoding. It affects all versions of wpDiscuz up to and including 7.6.43, and was discovered by researcher Doan Dinh Van, reported on November 25, 2025, and published on December 25–30, 2025. The vulnerability carries a CVSS v3.1 base score of 5.3 (Medium), exploitable by unauthenticated network attackers with no user interaction required (Patchstack).

The vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), which corresponds to an Insecure Direct Object Reference (IDOR) flaw. The plugin fails to properly validate or restrict access to objects based on user-supplied keys, allowing an unauthenticated attacker to manipulate object references in requests to access resources or data they should not be authorized to view. No authentication or special privileges are required, and the attack vector is network-accessible with low complexity. The flaw falls under OWASP Top 10 category A1: Broken Access Control (Patchstack).

Successful exploitation results in unauthorized read access to sensitive data managed by the wpDiscuz plugin, with a low confidentiality impact and no direct effect on integrity or availability. An unauthenticated attacker could bypass access controls to reference and retrieve objects (such as comment data or user-associated content) that should be restricted. While the individual impact per site is limited, Patchstack notes that vulnerabilities of this type are commonly used in mass-exploit campaigns targeting thousands of WordPress sites simultaneously (Patchstack).

No public proof-of-concept exploit code or confirmed in-the-wild exploitation has been reported for CVE-2025-68997 as of the available data. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. Patchstack classifies this as low priority with unlikely exploitation impact, though the unauthenticated, network-accessible attack vector lowers the barrier for opportunistic attackers (Patchstack).

The vulnerability is patched in wpDiscuz version 7.6.44. Site administrators should update the wpDiscuz plugin to version 7.6.44 or later immediately. If an immediate update is not possible, site owners should consult their hosting provider or web developer for assistance. Patchstack users can enable auto-update for vulnerable plugins to automate remediation (Patchstack).

Sucuri included CVE-2025-68997 in their December 2025 vulnerability patch roundup, highlighting it as part of broader WordPress plugin security advisories for the month (Sucuri Blog). No significant independent researcher commentary or notable social media discussion beyond standard vulnerability tracking has been observed.