{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-26968", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2025-02-17T11:51:40.974Z", "datePublished": "2025-04-17T15:17:14.732Z", "dateUpdated": "2026-04-23T14:04:43.904Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "cloak-front-end-email", "product": "Cloak Front End Email", "vendor": "webbernaut", "versions": [{"changes": [{"at": "1.9.6", "status": "unaffected"}], "lessThanOrEqual": "1.9.5", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Yudha - DJ | Patchstack Bug Bounty Program"}], "datePublic": "2026-04-22T14:30:01.275Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Missing Authorization vulnerability in webbernaut Cloak Front End Email cloak-front-end-email allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Cloak Front End Email: from n/a through <= 1.9.5.</p>"}], "value": "Missing Authorization vulnerability in webbernaut Cloak Front End Email cloak-front-end-email allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cloak Front End Email: from n/a through <= 1.9.5."}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "Missing Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-23T14:04:43.904Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/cloak-front-end-email/vulnerability/wordpress-cloak-front-end-email-1-9-5-broken-access-control-vulnerability?_s_id=cve"}], "title": "WordPress Cloak Front End Email <= 1.9.5 - Broken Access Control Vulnerability"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-04-17T15:49:06.095718Z", "id": "CVE-2025-26968", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-17T15:49:15.202Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-26968", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-04-17T15:49:06.095718Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-17T15:49:10.441Z"}}], "cna": {"title": "WordPress Cloak Front End Email <= 1.9.5 - Broken Access Control Vulnerability", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "muhammad yudha (Patchstack Alliance)"}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "webbernaut", "product": "Cloak Front End Email", "versions": [{"status": "affected", "changes": [{"at": "1.9.6", "status": "unaffected"}], "version": "n/a", "versionType": "custom", "lessThanOrEqual": "1.9.5"}], "packageName": "cloak-front-end-email", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Update the WordPress Cloak Front End Email plugin to the latest available version (at least 1.9.6).", "supportingMedia": [{"type": "text/html", "value": "Update the WordPress Cloak Front End Email plugin to the latest available version (at least 1.9.6).", "base64": false}]}], "references": [{"url": "https://patchstack.com/database/wordpress/plugin/cloak-front-end-email/vulnerability/wordpress-cloak-front-end-email-1-9-5-broken-access-control-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in webbernaut Cloak Front End Email allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Cloak Front End Email: from n/a through 1.9.5.", "supportingMedia": [{"type": "text/html", "value": "<p>Missing Authorization vulnerability in webbernaut Cloak Front End Email allows Exploiting Incorrectly Configured Access Control Security Levels.</p><p>This issue affects Cloak Front End Email: from n/a through 1.9.5.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2025-04-17T15:17:14.732Z"}}}, "cveMetadata": {"cveId": "CVE-2025-26968", "state": "PUBLISHED", "dateUpdated": "2025-04-17T15:49:15.202Z", "dateReserved": "2025-02-17T11:51:40.974Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2025-04-17T15:17:14.732Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in webbernaut Cloak Front End Email cloak-front-end-email allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cloak Front End Email: from n/a through <= 1.9.5."}, {"lang": "es", "value": "La vulnerabilidad de falta de autorizaci\u00f3n en webbernaut Cloak Front End Email permite explotar niveles de seguridad de control de acceso configurados incorrectamente. Este problema afecta al correo electr\u00f3nico de Cloak Front End desde n/d hasta la versi\u00f3n 1.9.5."}], "id": "CVE-2025-26968", "lastModified": "2026-04-23T15:26:09.460", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "audit@patchstack.com", "type": "Secondary"}]}, "published": "2025-04-17T16:15:34.613", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/Wordpress/Plugin/cloak-front-end-email/vulnerability/wordpress-cloak-front-end-email-1-9-5-broken-access-control-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "audit@patchstack.com", "type": "Secondary"}]}

{}

{}