The vulnerability CVE-2025-68048 affects XLPlugins NextMove Lite up to version 2.23.0 and is characterized by missing authorization checks in the woo-thank-you-page-nextmove-lite component. This results in incorrectly configured access control security levels, allowing unauthenticated remote attackers to access sensitive information or functionality that should be restricted. The CVSS 3.1 base score is 7.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, and high confidentiality impact with no impact on integrity or availability.

An attacker can exploit the missing authorization to gain unauthorized access to sensitive data or functionality within NextMove Lite, potentially compromising confidentiality. There is no reported impact on data integrity or system availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should monitor vendor communications for updates. No specific mitigations are provided in the current data.