The vulnerability identified as CVE-2025-68048 affects XLPlugins NextMove Lite up to version 2.23.0. It is caused by missing authorization checks in the woo-thank-you-page-nextmove-lite feature, which leads to incorrect access control enforcement. The issue allows an attacker to access functionality or data without proper authorization, potentially leading to high confidentiality impact. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates the vulnerability is remotely exploitable without authentication or user interaction, with a high impact on confidentiality but no impact on integrity or availability.

Successful exploitation of this vulnerability can result in unauthorized disclosure of sensitive information due to missing authorization controls. The attacker does not need any privileges or user interaction to exploit the flaw remotely. There is no indication of impact on data integrity or system availability. No known active exploits have been reported, reducing immediate risk, but the high confidentiality impact warrants attention.

No official patch or remediation information is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should monitor official XLPlugins communications for updates and consider restricting access to affected components where feasible.