CVE-2025-68514 describes an authorization bypass vulnerability in Cozmoslabs Paid Member Subscriptions plugin versions up to 2.16.8. The vulnerability is due to incorrectly configured access control security levels that can be exploited by manipulating a user-controlled key, allowing an attacker with limited privileges to perform unauthorized actions. The CVSS 3.1 vector indicates the attack requires network access, low attack complexity, and privileges, with no user interaction needed. The impact affects integrity but not confidentiality or availability. No patch or official fix information is currently available.

The vulnerability allows an attacker with limited privileges to bypass authorization controls, potentially enabling unauthorized modification or manipulation of data within the Paid Member Subscriptions plugin. There is no impact on confidentiality or availability reported. No known exploits are currently observed in the wild.

Patch status is not yet confirmed—check the vendor advisory for current remediation guidance. Since no official patch or fix is currently documented, users should monitor Cozmoslabs communications for updates. Until a fix is available, consider restricting access privileges to trusted users only and reviewing plugin configurations to minimize exposure.