CVE-2025-68521
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
Missing authorization in WpStream wpstream allows exploiting incorrectly configured access control security levels. This issue affects versions up to and including 4.9.5.
Risk Assessment
Unauthorized users may gain access to functions intended only for authorized users, potentially leading to unauthorized actions.
Recommendation
Update WpStream to the latest version that includes the fix.
Other vulnerabilities in WpStream
See all- CVE-2026-39527Medium
WpStream versions below 4.11.2 have a vulnerability allowing subscribers to upload arbitrary files.
- CVE-2026-39526Medium
The WpStream plugin contains an authorization bypass vulnerability through a user-controlled key, allowing exploitation of incorrectly configured access control security levels. This issue affects all versions from n/a through 4.11.2 (excluding 4.11.2).
- CVE-2025-68522Medium
Missing authorization in WpStream wpstream allows exploiting incorrectly configured access control security levels. This issue affects versions up to and including 4.9.5.
- CVE-2023-38512Medium
The WpStream plugin has a Cross-Site Request Forgery (CSRF) vulnerability, allowing unauthorized actions on behalf of the user. This issue affects versions from n/a to 4.5.4.
Original NVD description (English source)
Missing Authorization vulnerability in wpstream WpStream wpstream allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpStream: from n/a through <= 4.9.5.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS