CVE-2025-68882CWE-862

WordPress Scalenut plugin <= 1.1.5 - Broken Access Control vulnerability

High · published January 22, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
20.6
In the wild
Unconfirmed
What it is

⚡ A missing authorization check in Scalenut's access controls could let anyone waltz in and access sensitive data! Think of it like a restaurant that leaves the front door unlocked. Anyone could walk in, sit down, and help themselves to the kitchen without needing a reservation. That's how easily an attacker can exploit this vulnerability! An attacker could gain unauthorized access to user accounts, sensitive documents, or proprietary data—all because the front door was left ajar. This could lead to data breaches, loss of trust, and even legal repercussions for the organization. The stakes are high!

Put simply

Think of it like a restaurant that leaves the front door unlocked. Anyone could walk in, sit down, and help themselves to the kitchen without needing a reservation. That's how easily an attacker can exploit this vulnerability! This vulnerability allows unauthorized users to access restricted areas of the application due to improperly configured access control levels in Scalenut versions up to 1.1.5. Essentially, the system fails to validate user permissions correctly, making sensitive information available to anyone who asks.

What to do

An attacker could gain unauthorized access to user accounts, sensitive documents, or proprietary data—all because the front door was left ajar. This could lead to data breaches, loss of trust, and even legal repercussions for the organization. The stakes are high! To fix this, update Scalenut to the latest version immediately. Additionally, review and tighten your access control configurations to ensure that only authorized users can access sensitive areas. Regular security audits can help catch similar issues in the future! You've got this! With these steps, you’ll seal up those vulnerabilities and boost your security game! 🛡️

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00292 · 20.6th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-01-22T16:52Z
EPSS history
Timeline
  • 22 JAN 16:52Z
    WordPress Scalenut plugin <= 1.1.5 - Broken Access Control vulnerability
    cvelistv5