CVE-2025-68557

The vulnerability is a missing authorization check in the WordPress Chakra test plugin versions 1.0.1 and earlier. This allows exploitation of incorrectly configured access control security levels, enabling unauthenticated users to perform actions that should require higher privileges [1].

Attackers can exploit this issue remotely without needing any authentication or user interaction. The attack complexity is low, and the vulnerability can be chained with other flaws to compromise websites running the plugin. Security researchers note such flaws are commonly used in mass-exploit campaigns targeting thousands of WordPress sites [1].

Successful exploitation grants attackers the ability to execute higher-privileged actions, potentially leading to site defacement, data theft, or further compromise. Although the CVSS score of 4.3 indicates medium severity, the real-world impact can be significant due to the ease of exploitation [1].

The issue is patched in version 1.0.2. Users are strongly advised to update immediately. Patchstack users can enable auto-updates for vulnerable plugins. If update is not possible, contact your hosting provider for mitigation [1].