CVE-2025-68000

Vulnerability

Overview The vulnerability is a Missing Authorization issue in the PickPlugins Testimonial Slider plugin for WordPress, affecting versions from n/a through 2.0.15. It arises from incorrectly configured access control security levels, which allows unauthenticated users to perform actions reserved for higher-privileged roles [1]. This is classified as a broken access control flaw, meaning the plugin fails to properly enforce authorization checks in certain functions.

Attack

Vector and Prerequisites The attack does not require authentication requirement is none, so any unauthenticated user can exploit this vulnerability over the network. The attacker does not need a valid account or any special privileges within WordPress. The vulnerability is expected to be exploited in mass campaigns against thousands of websites, regardless of site size [1].

Impact

Successful exploitation allows an attacker to exercise capabilities that should be restricted to authorized users. While the CVSSv3 score is 6.5 (Medium), the actual risk is elevated impact could be higher given the potential for unauthenticated privilege escalation, such as modifying plugin data or configuration [1].

Mitigation

The immediate mitigation is to update the Testimonial Slider plugin to a patched version beyond 2.0.15. If updating is not possible, users are advised to contact their hosting provider or web developer for assistance [1].