PT-2025-53813 · WordPress · Cubewp

Md Ismail · CVE-2025-68036 · Published 2025-12-29 · Updated 2026-01-04

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions CubeWP versions through 1.1.27

Description A missing authorization issue exists in CubeWP, allowing access to functionality that is not properly restricted by Access Control Lists (ACLs). This could allow unauthorized access to certain features or data within the application.

Recommendations Update CubeWP to a version later than 1.1.27.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-68036

Affected Products

Cubewp

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-68036 · Security Note
• https://t.me/CVEtracker/40897 · Telegram Post
• https://patchstack.com/database/Wordpress/Plugin/cubewp-framework/vulnerability/wordpress-cubewp-plugin-1-1-27-broken-access-control-vulnerability?_s_id=cve · Note
• https://twitter.com/cracbot/status/2007769018376364534 · Twitter Post
• https://twitter.com/CVEnew/status/2005788752992690325 · Twitter Post
• https://patchstack.com/database/wordpress/plugin/cubewp-framework/vulnerability/wordpress-cubewp-plugin-1-1-27-broken-access-control-vulnerability?_s_id=cve · Note
• https://vdp.patchstack.com/database/wordpress/plugin/cubewp-framework/vulnerability/wordpress-cubewp-plugin-1-1-27-broken-access-control-vulnerability?_s_id=cve · Note
• https://twitter.com/VulmonFeeds/status/2005890351995793866 · Twitter Post