{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-68057", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2025-12-15T10:01:11.955Z", "datePublished": "2026-01-22T16:52:06.352Z", "dateUpdated": "2026-04-28T16:14:27.857Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://elements.envato.com", "defaultStatus": "unaffected", "packageName": "hospital-doctor-directory", "product": "Hospital Doctor Directory", "vendor": "e-plugins", "versions": [{"lessThanOrEqual": "1.3.9", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Phat RiO | Patchstack Bug Bounty Program"}], "datePublic": "2026-04-22T14:22:01.914Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Missing Authorization vulnerability in e-plugins Hospital Doctor Directory hospital-doctor-directory allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Hospital Doctor Directory: from n/a through <= 1.3.9.</p>"}], "value": "Missing Authorization vulnerability in e-plugins Hospital Doctor Directory hospital-doctor-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hospital Doctor Directory: from n/a through <= 1.3.9."}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.6, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "Missing Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-28T16:14:27.857Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/hospital-doctor-directory/vulnerability/wordpress-hospital-doctor-directory-plugin-1-3-9-broken-access-control-vulnerability-2?_s_id=cve"}], "title": "WordPress Hospital Doctor Directory plugin <= 1.3.9 - Broken Access Control vulnerability"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-28T17:02:16.652926Z", "id": "CVE-2025-68057", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-27T18:31:08.966Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-68057", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-28T17:02:16.652926Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-28T17:02:12.663Z"}}], "cna": {"title": "WordPress Hospital Doctor Directory plugin <= 1.3.9 - Broken Access Control vulnerability", "credits": [{"lang": "en", "type": "finder", "value": "Phat RiO | Patchstack Bug Bounty Program"}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "e-plugins", "product": "Hospital Doctor Directory", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "1.3.9"}], "packageName": "hospital-doctor-directory", "collectionURL": "https://elements.envato.com", "defaultStatus": "unaffected"}], "datePublic": "2026-04-22T14:22:01.914Z", "references": [{"url": "https://patchstack.com/database/Wordpress/Plugin/hospital-doctor-directory/vulnerability/wordpress-hospital-doctor-directory-plugin-1-3-9-broken-access-control-vulnerability-2?_s_id=cve", "tags": ["vdb-entry"]}], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in e-plugins Hospital Doctor Directory hospital-doctor-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hospital Doctor Directory: from n/a through <= 1.3.9.", "supportingMedia": [{"type": "text/html", "value": "Missing Authorization vulnerability in e-plugins Hospital Doctor Directory hospital-doctor-directory allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Hospital Doctor Directory: from n/a through <= 1.3.9.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "Missing Authorization"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-23T14:13:56.032Z"}}}, "cveMetadata": {"cveId": "CVE-2025-68057", "state": "PUBLISHED", "dateUpdated": "2026-04-27T18:31:08.966Z", "dateReserved": "2025-12-15T10:01:11.955Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2026-01-22T16:52:06.352Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in e-plugins Hospital Doctor Directory hospital-doctor-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hospital Doctor Directory: from n/a through <= 1.3.9."}, {"lang": "es", "value": "Vulnerabilidad de falta de autorizaci\u00f3n en e-plugins Hospital Doctor Directory hospital-doctor-directory permite la explotaci\u00f3n de niveles de seguridad de control de acceso mal configurados. Este problema afecta a Hospital Doctor Directory: desde n/a hasta &lt;= 1.3.9."}], "id": "CVE-2025-68057", "lastModified": "2026-04-27T19:16:23.920", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.6, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.7, "source": "audit@patchstack.com", "type": "Secondary"}]}, "published": "2026-01-22T17:16:09.623", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/Wordpress/Plugin/hospital-doctor-directory/vulnerability/wordpress-hospital-doctor-directory-plugin-1-3-9-broken-access-control-vulnerability-2?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "audit@patchstack.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-28T09:52:12.400624+00:00", "value": {"mitigation_remediation": ["Apply the vendor\u2011published patch that addresses the CWE\u2011862 Missing Authorization issue, ensuring the missing access control checks are removed.", "Restrict the plugin\u2019s functionality so that only administrators have access, adjusting user roles accordingly.", "If the plugin is not essential, consider removing or disabling it from the site."], "summary": {"action": "Immediate Patch", "impact": "Unauthorized Access to Sensitive Data"}, "threat_synthesis": {"affected_systems": "The affected software is the Hospital Doctor Directory plugin developed by e\u2011plugins. Any installation running version\u202f1.3.9 or older is vulnerable. The plugin is used within WordPress sites to manage doctor directory entries.", "description_and_impact": "This vulnerability is a CWE\u2011862 Missing Authorization flaw within the Hospital Doctor Directory plugin. The plugin lacks proper access control checks, allowing an unauthenticated or minimally privileged user to invoke functions normally reserved for administrators. As a result, attackers could read, modify, or delete doctor profile data, compromising confidentiality, integrity and potentially availability if the functionality is abused widely.", "risk_and_exploitability": "With a CVSS score of 7.6 the vulnerability is considered high severity. The EPSS score of less than 1% indicates a low probability of exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through the web interface of the WordPress site; an attacker can send crafted requests to the plugin\u2019s endpoints to gain unauthorized access. No authentication is required, as the flaw stems from missing access control checks. If an adversary can reach the site, the exploitation is straightforward, but the overall risk is tempered by the low exploitation probability."}}}}, "created": "2026-01-23T16:29:39.643857+00:00", "updated": "2026-04-28T10:00:06.494296+00:00", "vendors": ["e-plugins", "e-plugins$PRODUCT$hospital_&_doctor_directory", "wordpress", "wordpress$PRODUCT$wordpress"]}