CVE-2025-68058CWE-862

WordPress Institutions Directory plugin <= 1.3..4 - Broken Access Control vulnerability

High · published January 22, 2026

CVSS v3.1
7.6
EPSS
0%
Percentile
23.0
In the wild
Unconfirmed
What it is

⚡ A simple misconfiguration is your greatest weakness. The Institutions Directory's access controls are like a busy café where anyone can enter the staff-only area without a second glance! Picture a restaurant where the kitchen door is wide open, allowing anyone to help themselves to the ingredients — that's what this missing authorization allows. An attacker could stroll right in and potentially access sensitive information, just like a rogue diner raiding the supply cabinet! This vulnerability lets unauthorized users access restricted data, meaning they could see confidential information or make changes that could disrupt operations. Imagine the chaos if your sensitive details ended up in the wrong hands! This could lead to serious data breaches and trust issues.

Put simply

Picture a restaurant where the kitchen door is wide open, allowing anyone to help themselves to the ingredients — that's what this missing authorization allows. An attacker could stroll right in and potentially access sensitive information, just like a rogue diner raiding the supply cabinet! The missing authorization vulnerability in e-plugins Institutions Directory allows users to bypass access control checks, exposing sensitive areas of the application that should be protected. Affected versions are from n/a through 1.3.4, and the flaw arises from incorrectly configured security levels.

What to do

This vulnerability lets unauthorized users access restricted data, meaning they could see confidential information or make changes that could disrupt operations. Imagine the chaos if your sensitive details ended up in the wrong hands! This could lead to serious data breaches and trust issues. To address this, ensure strict access control measures are implemented by updating to the latest version. Regularly review your access configurations and restrict user permissions to the necessary minimum to prevent unauthorized access. Don't wait; secure your systems today! You've got this! By following these steps, you can lock this vulnerability down and enhance your security measures! 🛡️

The record
Technical detail
CVSS v3.1
7.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00313 · 23.0th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-01-22T16:52Z
EPSS history
Timeline
  • 22 JAN 16:52Z
    WordPress Institutions Directory plugin <= 1.3..4 - Broken Access Control vulnerability
    cvelistv5