{"affected":[{"defaultStatus":"unaffected","ecosystem":"https://wordpress.org/plugins","packageName":"cooked","product":"Cooked","source":"CNA: Patchstack","vendor":"Gora Tech","versions":[{"changes":[{"at":"1.11.4","status":"unaffected"}],"lessThanOrEqual":"1.11.3","status":"affected","version":"0","versionType":"custom"}]}],"cveId":"CVE-2025-68586","cwes":["CWE-862"],"description":"Missing Authorization vulnerability in Gora Tech Cooked cooked allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cooked: from n/a through <= 1.11.3.","epss":{"date":"2026-11-03","percentile":0.1709,"score":0.00254},"exploits":[],"kev":null,"metrics":[{"score":5.3,"severity":"medium","source":"CNA: Patchstack","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"}],"modifiedAt":1793751311383,"publishedAt":1766581842037,"references":[{"source":"CNA: Patchstack","tags":["vdb-entry"],"url":"https://patchstack.com/database/Wordpress/Plugin/cooked/vulnerability/wordpress-cooked-plugin-1-11-2-broken-access-control-vulnerability?_s_id=cve"}],"remediation":[],"revision":"8c5312c6796ea9eb5cb514b3d316332b96455d23cc1702d1e9405e9aa7007a7c","sources":[{"modifiedAt":1793751311383,"name":"CNA: Patchstack","retrievedAt":1793754632468,"url":"https://www.cve.org/CVERecord?id=CVE-2025-68586"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793748165377,"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-68586"}],"ssvc":{"assessedAt":1777315717365,"automatable":"yes","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"WordPress Cooked plugin <= 1.11.3 - Broken Access Control vulnerability","updatedAt":1793754632468}