CVE-2025-68498

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-68498", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2025-12-19T10:16:41.921Z", "datePublished": "2025-12-29T23:13:35.444Z", "dateUpdated": "2026-04-28T16:14:28.789Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://crocoblock.com", "defaultStatus": "unaffected", "packageName": "jet-tabs", "product": "JetTabs", "vendor": "Crocoblock", "versions": [{"changes": [{"at": "2.2.12.1", "status": "unaffected"}], "lessThanOrEqual": "2.2.12", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Bonds | Patchstack Bug Bounty Program"}], "datePublic": "2026-04-01T16:43:53.188Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Missing Authorization vulnerability in Crocoblock JetTabs jet-tabs allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects JetTabs: from n/a through <= 2.2.12.</p>"}], "value": "Missing Authorization vulnerability in Crocoblock JetTabs jet-tabs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetTabs: from n/a through <= 2.2.12."}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "Missing Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-28T16:14:28.789Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/jet-tabs/vulnerability/wordpress-jettabs-plugin-2-2-12-broken-access-control-vulnerability?_s_id=cve"}], "title": "WordPress JetTabs plugin <= 2.2.12 - Broken Access Control vulnerability"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-30T18:48:29.226161Z", "id": "CVE-2025-68498", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-30T18:48:36.471Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-68498", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-30T18:48:29.226161Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-30T18:48:33.853Z"}}], "cna": {"tags": ["x_open-source"], "title": "WordPress JetTabs plugin <= 2.2.12 - Broken Access Control vulnerability", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Bonds | Patchstack Bug Bounty Program"}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Crocoblock", "product": "JetTabs", "versions": [{"status": "affected", "changes": [{"at": "2.2.12.1", "status": "unaffected"}], "version": "n/a", "versionType": "custom", "lessThanOrEqual": "2.2.12"}], "packageName": "jet-tabs", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Update the WordPress JetTabs Plugin to the latest available version (at least 2.2.12.1).", "supportingMedia": [{"type": "text/html", "value": "Update the WordPress JetTabs Plugin to the latest available version (at least 2.2.12.1).", "base64": false}]}], "references": [{"url": "https://vdp.patchstack.com/database/wordpress/plugin/jet-tabs/vulnerability/wordpress-jettabs-plugin-2-2-12-broken-access-control-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in Crocoblock JetTabs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetTabs: from n/a through 2.2.12.", "supportingMedia": [{"type": "text/html", "value": "Missing Authorization vulnerability in Crocoblock JetTabs allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects JetTabs: from n/a through 2.2.12.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2025-12-29T23:13:35.444Z"}}}, "cveMetadata": {"cveId": "CVE-2025-68498", "state": "PUBLISHED", "dateUpdated": "2025-12-30T18:48:36.471Z", "dateReserved": "2025-12-19T10:16:41.921Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2025-12-29T23:13:35.444Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://crocoblock.com", "defaultStatus": "unaffected", "packageName": "jet-tabs", "product": "JetTabs", "vendor": "Crocoblock", "versions": [{"changes": [{"at": "2.2.12.1", "status": "unaffected"}], "lessThanOrEqual": "2.2.12", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "audit@patchstack.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in Crocoblock JetTabs jet-tabs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetTabs: from n/a through <= 2.2.12."}, {"lang": "es", "value": "Vulnerabilidad de autorizaci\u00f3n faltante en Crocoblock JetTabs permite la explotaci\u00f3n de niveles de seguridad de control de acceso configurados incorrectamente. Este problema afecta a JetTabs: desde n/a hasta 2.2.12."}], "id": "CVE-2025-68498", "lastModified": "2026-10-07T12:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "audit@patchstack.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-68498", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-12-30T18:48:29.226161Z", "version": "2.0.3"}}]}, "published": "2025-12-30T00:15:52.440", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/Wordpress/Plugin/jet-tabs/vulnerability/wordpress-jettabs-plugin-2-2-12-broken-access-control-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "audit@patchstack.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-29T01:00:56.530897+00:00", "value": {"mitigation_remediation": ["Upgrade JetTabs to any version newer than 2.2.12.", "If upgrading is not possible, disable or remove the JetTabs plugin for all users who do not require its functionality.", "Restrict user roles that can access JetTabs features so that only administrators or trusted roles are allowed to interact with the plugin."], "summary": {"action": "Patch Plugin", "impact": "Unauthorized Access"}, "threat_synthesis": {"affected_systems": "Crocoblock JetTabs plugin is affected, with all releases through version 2.2.12 inclusive.", "description_and_impact": "The vulnerability is a missing authorization flaw that allows attackers to access or modify JetTabs content and configuration settings that they should not be able to reach. Because the plugin does not enforce authorization checks, users with insufficient privileges can exploit its functionality. Based on the description, it is inferred that this flaw can enable reading sensitive configuration information or altering settings, potentially giving an attacker a foothold to compromise the WordPress site further. The weakness is identified as CWE\u2011862.", "risk_and_exploitability": "The CVSS score of 6.5 indicates medium severity, while the EPSS score of less than 1% shows a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. It is inferred that exploitation requires a web\u2011based request to JetTabs endpoints, which a remote attacker with network access to the WordPress instance can perform. No special prerequisites beyond normal site access are noted in the description."}}}}, "created": "2026-01-05T10:23:10.876803+00:00", "updated": "2026-04-29T01:15:44.720362+00:00", "vendors": ["crocoblock", "crocoblock$PRODUCT$jettabs", "wordpress", "wordpress$PRODUCT$wordpress"]}