CVE-2025-68026
Missing Authorization in LC Wizard ≤ 2.1.1 Enables Unauthorized Access
Publication date: 2026-02-20
Last updated on: 2026-02-24
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| patchstack | ghl_wizard | to 2.1.1 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': "CVE-2025-68026 is a medium severity vulnerability affecting the WordPress LC Wizard Plugin versions up to and including 2.1.1. It is a 'Settings Change' vulnerability caused by broken access control, meaning that unauthorized users can change plugin settings without proper authorization."}, {'type': 'paragraph', 'content': 'This vulnerability allows unauthenticated attackers to exploit incorrectly configured access control security levels, enabling them to modify settings within the plugin.'}] [1]
How can this vulnerability impact me? :
This vulnerability can impact you by allowing attackers with no privileges to change settings in the LC Wizard plugin, potentially compromising the security and functionality of your WordPress site.
Because the vulnerability requires no authentication, it increases the risk of exploitation, which could lead to unauthorized configuration changes that may affect site behavior or security.
Users are strongly advised to update to version 2.1.2 or later to mitigate this risk.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
CVE-2025-68026 affects the WordPress LC Wizard Plugin versions up to and including 2.1.1 and allows unauthenticated attackers to change plugin settings due to broken access control.
Detection can involve monitoring for unauthorized changes to the LC Wizard plugin settings or scanning for the presence of vulnerable plugin versions (<= 2.1.1).
Specific commands are not provided in the available resources, but typical approaches include:
- Checking the installed plugin version via WordPress admin or command line tools like WP-CLI.
- Monitoring web server logs for suspicious requests targeting the LC Wizard plugin endpoints.
- Using security plugins or tools that detect unauthorized settings changes or access control violations.
What immediate steps should I take to mitigate this vulnerability?
The primary mitigation step is to update the LC Wizard plugin to version 2.1.2 or later, which contains the fix for this vulnerability.
Until the update can be applied, Patchstack provides rules that block attacks targeting this vulnerability, which can be used as a temporary protective measure.
Additionally, enabling continuous security monitoring and automatic updates for vulnerable plugins can help reduce risk.