CVE-2025-68576CWE-497

CVE-2025-68576

Medium · published December 24, 2025

CVSS v3.1
4.3
EPSS
0%
Percentile
16.1
In the wild
Unconfirmed
What it is

⚠️ Sensitive system information is exposed, leaving you vulnerable! Virusdie versions up to 1.1.6 allow unauthorized access to embedded sensitive data — like a banker leaving their vault door wide open! 😱 Think of it like a restaurant that forgets to lock the kitchen door — anyone passing by can just stroll in and see the secret recipes. In this case, unauthorized users can retrieve sensitive data that should be carefully guarded. An attacker could exploit this vulnerability to access critical information that could lead to further attacks or data leaks. It's like giving away the blueprints to your security system — once in the wrong hands, the consequences can be quite damaging!

Put simply

Think of it like a restaurant that forgets to lock the kitchen door — anyone passing by can just stroll in and see the secret recipes. In this case, unauthorized users can retrieve sensitive data that should be carefully guarded. This vulnerability arises due to insufficient access controls in Virusdie, allowing unauthorized users to retrieve sensitive embedded data. It affects versions from n/a up to 1.1.6.

What to do

An attacker could exploit this vulnerability to access critical information that could lead to further attacks or data leaks. It's like giving away the blueprints to your security system — once in the wrong hands, the consequences can be quite damaging! To protect against this vulnerability, update Virusdie to the latest version that addresses this issue. Additionally, review your access control settings to ensure sensitive information is properly secured. You've got this! With a quick update, you can ensure your system is safe and sound again. 🛡️

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00255 · 16.1th percentile
Weakness
CWE-497 · Exposure of Sensitive System Information to an Unauthorized Control Sphere
Published
2025-12-24T18:16Z
References (1)
EPSS history
Timeline
  • 24 DEC 13:10Z
    WordPress Virusdie plugin <= 1.1.6 - Sensitive Data Exposure vulnerability
    cvelistv5