{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-68024", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2025-12-15T10:00:59.034Z", "datePublished": "2026-02-20T15:46:35.579Z", "dateUpdated": "2026-04-28T19:55:21.612Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "addonify-wishlist", "product": "Addonify \u2013 WooCommerce Wishlist", "vendor": "Addonify", "versions": [{"changes": [{"at": "2.0.16", "status": "unaffected"}], "lessThanOrEqual": "2.0.15", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Legion Hunter | Patchstack Bug Bounty Program"}], "datePublic": "2026-04-01T16:02:15.587Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Missing Authorization vulnerability in Addonify Addonify \u2013 WooCommerce Wishlist addonify-wishlist allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Addonify \u2013 WooCommerce Wishlist: from n/a through <= 2.0.15.</p>"}], "value": "Missing Authorization vulnerability in Addonify Addonify \u2013 WooCommerce Wishlist addonify-wishlist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Addonify \u2013 WooCommerce Wishlist: from n/a through <= 2.0.15."}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "Missing Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-28T16:14:26.714Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/addonify-wishlist/vulnerability/wordpress-addonify-woocommerce-wishlist-plugin-2-0-15-settings-change-vulnerability?_s_id=cve"}], "title": "WordPress Addonify \u2013 WooCommerce Wishlist plugin <= 2.0.15 - Settings Change vulnerability"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-24T21:32:07.755434Z", "id": "CVE-2025-68024", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-28T19:55:21.612Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-68024", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-24T21:32:07.755434Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-24T21:32:09.427Z"}}], "cna": {"title": "WordPress Addonify \u2013 WooCommerce Wishlist plugin <= 2.0.15 - Settings Change vulnerability", "credits": [{"lang": "en", "type": "finder", "value": "Legion Hunter | Patchstack Bug Bounty Program"}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "affected": [{"vendor": "Addonify", "product": "Addonify \u2013 WooCommerce Wishlist", "versions": [{"status": "affected", "changes": [{"at": "2.0.16", "status": "unaffected"}], "version": "n/a", "versionType": "custom", "lessThanOrEqual": "<= 2.0.15"}], "packageName": "addonify-wishlist", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}], "datePublic": "2026-02-20T16:43:49.967Z", "references": [{"url": "https://patchstack.com/database/Wordpress/Plugin/addonify-wishlist/vulnerability/wordpress-addonify-woocommerce-wishlist-plugin-2-0-15-settings-change-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in Addonify Addonify \u2013 WooCommerce Wishlist addonify-wishlist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Addonify \u2013 WooCommerce Wishlist: from n/a through <= 2.0.15.", "supportingMedia": [{"type": "text/html", "value": "Missing Authorization vulnerability in Addonify Addonify \u2013 WooCommerce Wishlist addonify-wishlist allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Addonify \u2013 WooCommerce Wishlist: from n/a through <= 2.0.15.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "Missing Authorization"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-02-20T15:46:35.579Z"}}}, "cveMetadata": {"cveId": "CVE-2025-68024", "state": "PUBLISHED", "dateUpdated": "2026-02-24T21:35:27.062Z", "dateReserved": "2025-12-15T10:00:59.034Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2026-02-20T15:46:35.579Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in Addonify Addonify \u2013 WooCommerce Wishlist addonify-wishlist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Addonify \u2013 WooCommerce Wishlist: from n/a through <= 2.0.15."}, {"lang": "es", "value": "Vulnerabilidad por ausencia de autorizaci\u00f3n en Addonify Addonify \u2013 WooCommerce Wishlist addonify-wishlist permite la explotaci\u00f3n de niveles de seguridad de control de acceso configurados incorrectamente. Este problema afecta a Addonify \u2013 WooCommerce Wishlist: desde n/a hasta &lt;= 2.0.15."}], "id": "CVE-2025-68024", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.5, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2026-02-20T16:22:07.527", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/Wordpress/Plugin/addonify-wishlist/vulnerability/wordpress-addonify-woocommerce-wishlist-plugin-2-0-15-settings-change-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "audit@patchstack.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.0.15]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "2.0.16"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Addonify \u2013 WooCommerce Wishlist", "source": "cna", "vendor": "Addonify"}, "product": "addonify_\u2013_woocommerce_wishlist", "vendor": "addonify"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-28T09:37:10.941612+00:00", "value": {"mitigation_remediation": ["Update the Addonify \u2013 WooCommerce Wishlist plugin to version 2.0.16 or later, which includes the access control fix.", "Restrict the plugin\u2019s settings page so that only users with the administrator role can make changes by verifying role checks in the WordPress back\u2011end.", "Review the current wishlist configuration for unexpected values and consult server logs for unauthorized modifications to confirm whether the vulnerability has been exploited."], "summary": {"action": "Update Plugin", "impact": "Unauthorized Modification of Plugin Settings"}, "threat_synthesis": {"affected_systems": "All installations of Addonify \u2013 WooCommerce Wishlist for WordPress that are at version 2.0.15 or earlier are susceptible. The flaw is confined to the plugin\u2019s settings interface and does not affect WordPress core or unrelated plugins.", "description_and_impact": "WordPress Addonify \u2013 WooCommerce Wishlist plugin suffers a missing authorization flaw that allows an attacker to modify plugin settings without proper privilege verification. The vulnerability stems from an incorrectly implemented access control check, enabling unauthorized configuration changes. Altering these settings can disrupt normal wishlist functionality and potentially expose the site to further risks if the plugin\u2019s configuration is used to control other features, but no additional exploitation beyond configuration changes is indicated in the CVE description.", "risk_and_exploitability": "The CVSS score of 6.5 signals moderate severity. The EPSS score is below 1%, implying a low likelihood of exploitation at present, and the vulnerability is not listed in CISA\u2019s KEV catalog. Likely exploitation occurs via the plugin\u2019s settings page accessed in a web browser; it is inferred that the attacker may need any authenticated WordPress user whose session the plugin incorrectly trusts, but the CVE data does not explicitly state the required authentication level."}}}}, "created": "2026-02-23T14:45:49.094834+00:00", "updated": "2026-04-28T09:45:28.451323+00:00", "vendors": ["addonify", "addonify$PRODUCT$addonify_\u2013_woocommerce_wishlist", "wordpress", "wordpress$PRODUCT$wordpress"]}