CVE-2025-68585CWE-862broken-access-control

CVE-2025-68585

Low · published December 24, 2025

CVSS v3.1
2.7
EPSS
0%
Percentile
14.6
In the wild
Unconfirmed
What it is

⚠️ A sneaky missing authorization issue is lurking in WP Document Revisions, potentially letting unauthorized users peek behind the curtain! Think of it like an open filing cabinet in an office — anyone can stroll by and read confidential documents without anyone checking who they are. This vulnerability means that users with improper access controls could view or manipulate documents they shouldn't have access to. While this might sound low-key, it can lead to sensitive information being mishandled or exposed. Imagine someone stumbling upon confidential revisions — that's not just awkward, it's potentially damaging!

Put simply

Think of it like an open filing cabinet in an office — anyone can stroll by and read confidential documents without anyone checking who they are. This vulnerability means that users with improper access controls could view or manipulate documents they shouldn't have access to. This vulnerability occurs due to improperly configured access control settings, which allows unauthorized users to access document revisions within the WP Document Revisions plugin, versions n/a through 3.7.2.

What to do

While this might sound low-key, it can lead to sensitive information being mishandled or exposed. Imagine someone stumbling upon confidential revisions — that's not just awkward, it's potentially damaging! To secure your system, update the WP Document Revisions plugin to the latest version. Review your access control configurations to ensure that only authorized users can view sensitive data. You've got this! With a quick update and a few security checks, you can keep your site safe and sound! 🛡️

The record
Technical detail
CVSS v3.1
2.7 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00243 · 14.6th percentile
Weakness
CWE-862 · Missing Authorization
Published
2025-12-24T18:16Z
References (1)
EPSS history
Timeline
  • 24 DEC 13:10Z
    WordPress WP Document Revisions plugin <= 3.7.2 - Broken Access Control vulnerability
    cvelistv5