CVE-2025-68596

MediumCVSS 5.3

Published: 24/12/2025(UTC)Updated: 07/10/2026(UTC)Translated: 07/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

18th percentile - higher than 18% of all known CVEs

Summary

The Bit Assist plugin (versions up to and including 1.5.11) contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This issue affects Bit Assist from n/a through 1.5.11.

Risk Assessment

An attacker could gain access to functions or data without the required permissions, potentially leading to unauthorized configuration changes or information disclosure.

Recommendation

Update the Bit Assist plugin to a version later than 1.5.11 that fixes the vulnerability. Review and correct WordPress role permissions.

Other vulnerabilities in Bit Assist

CVE-2026-39070Medium
The WordPress plugin (Bit Assist) before version 1.7.2 is affected by Stored Cross-Site Scripting in the Call-To-Action feature. An authenticated attacker with the privileged role (admin) can exploit this to redirect users to a malicious site or control the account.

Original NVD description (English source)

Missing Authorization vulnerability in Bit Apps Bit Assist bit-assist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bit Assist: from n/a through <= 1.5.11.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS