CVE-2025-68577CWE-862broken-access-control

CVE-2025-68577

Medium · published December 24, 2025

CVSS v3.1
4.3
EPSS
0%
Percentile
11.8
In the wild
Unconfirmed
What it is

⚠️ A missing authorization issue in Virusdie could let anyone access restricted areas without a password — like a hotel guest sneaking into the VIP lounge without a key! 🔑 Think of it as a hotel where the staff forgot to check guests' IDs before letting them into exclusive areas; anyone could waltz in and take advantage of the amenities without any verification! This vulnerability could allow unauthorized users to exploit incorrectly configured access controls, potentially leading to data leaks or unauthorized actions within your system. If not addressed, it could compromise sensitive information and disrupt operations, putting your organization's integrity at risk.

Put simply

Think of it as a hotel where the staff forgot to check guests' IDs before letting them into exclusive areas; anyone could waltz in and take advantage of the amenities without any verification! The missing authorization flaw in Virusdie allows for bypassing security levels due to improper access control configurations, affecting all versions from n/a to 1.1.6.

What to do

This vulnerability could allow unauthorized users to exploit incorrectly configured access controls, potentially leading to data leaks or unauthorized actions within your system. If not addressed, it could compromise sensitive information and disrupt operations, putting your organization's integrity at risk. To secure your system, upgrade Virusdie to the latest version immediately, and closely review your access control settings to enforce proper verification. It's crucial to conduct an audit to prevent unauthorized access in the future. You've got this! With these steps, you'll bolster your defenses and keep your data safe. 🛡️

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00220 · 11.8th percentile
Weakness
CWE-862 · Missing Authorization
Published
2025-12-24T18:16Z
References (1)
EPSS history
Timeline
  • 24 DEC 13:10Z
    WordPress Virusdie plugin <= 1.1.6 - Broken Access Control vulnerability
    cvelistv5