CVE-2025-68521CWE-862broken-access-control

CVE-2025-68521

Medium · published December 24, 2025

CVSS v3.1
5.3
EPSS
0%
Percentile
11.6
In the wild
Unconfirmed
What it is

⚠️ An improperly set access control could put your WpStream at risk! Users might just waltz in without any permissions.🙈 Think of it like a VIP lounge where the bouncer is taking a nap. Anyone could walk in without a reservation or membership — a recipe for chaos! If not addressed, users could gain unauthorized access to restricted areas of your site. This could lead to data leaks or even tampering with sensitive content, creating a potential disaster for your business.

Put simply

Think of it like a VIP lounge where the bouncer is taking a nap. Anyone could walk in without a reservation or membership — a recipe for chaos! This missing authorization vulnerability in WpStream allows attackers to exploit incorrectly configured access control levels, letting unauthorized users access areas they shouldn't.

What to do

If not addressed, users could gain unauthorized access to restricted areas of your site. This could lead to data leaks or even tampering with sensitive content, creating a potential disaster for your business. Patch your WpStream plugin to version 4.9.6 or later to rectify these access issues. Additionally, review your access control settings to ensure they're configured properly and limit user privileges where necessary. You've got this! Follow these steps and your site will be secure in no time. 🛡️

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00218 · 11.6th percentile
Weakness
CWE-862 · Missing Authorization
Published
2025-12-24T18:16Z
References (1)
EPSS history
Timeline
  • 24 DEC 12:31Z
    WordPress WpStream plugin <= 4.9.5 - Broken Access Control vulnerability
    cvelistv5