CVE-2025-68981

WordPress HomeFix Elementor Portfolio plugin <= 1.0.1 - Broken Access Control vulnerability

View on CVE.org
Published Dec 30, 2025 CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Description
Missing Authorization vulnerability in designthemes HomeFix Elementor Portfolio homefix-ele-portfolio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HomeFix Elementor Portfolio: from n/a through <= 1.0.1.

Analysis

AI-generated

Technical impact

The vulnerability is a missing authorization flaw that allows attackers to bypass correctly configured access control levels. This enables unauthorized users to access, create, or modify resources that should be restricted, potentially exposing sensitive portfolio data or altering content. The weakness falls under CWE‑862, which identifies missing or incomplete authorization checks.

Affected Systems

The issue affects the HomeFix Elementor Portfolio plugin by designthemes in all releases from the first version up to and including 1.0.1. No newer versions are listed as affected.

Risk and Exploitability

With a CVSS score of 5.3, the flaw poses moderate severity, and an EPSS score of less than 1% indicates a low probability of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, through the plugin's web interface, and requires no special credentials; attackers can craft requests that bypass the plugin’s access checks to read or alter restricted data.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the HomeFix Elementor Portfolio plugin to a version newer than 1.0.1
  • If an updated version is not available, disable or uninstall the plugin until a fix is released
  • Enforce strict role‑based access control by configuring the plugin or the hosting environment so that only administrators can perform actions related to portfolio items

Generated by OpenCVE AI on April 29, 2026 at 15:07 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

 cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}
Type Values Removed Values Added
First Time appeared Designthemes
Designthemes homefix Elementor Portfolio
Elementor
Elementor elementor
Wordpress
Wordpress wordpress
Vendors & Products Designthemes
Designthemes homefix Elementor Portfolio
Elementor
Elementor elementor
Wordpress
Wordpress wordpress
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Missing Authorization vulnerability in designthemes HomeFix Elementor Portfolio homefix-ele-portfolio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HomeFix Elementor Portfolio: from n/a through <= 1.0.1.
Title WordPress HomeFix Elementor Portfolio plugin <= 1.0.1 - Broken Access Control vulnerability
Weaknesses CWE-862
References
Earlier changes (2)
Weaknesses

Sources

Status
PUBLISHED
Assigner
Patchstack
Published
Updated
Apr 28, 2026, 4:14 PM
Reserved
Dec 29, 2025, 11:17 AM

View source JSON

Updated
Dec 30, 2025, 9:47 PM

JSON

Status
Deferred
Published
Dec 30, 2025, 11:15 AM
Modified
Oct 7, 2026, 12:10 PM

View source JSON

No data.

Updated
Apr 29, 2026, 3:15 PM

JSON