CVE-2025-58668 is a medium severity (CVSS 4.3) missing authorization flaw in WPLMS, the WordPress learning management theme from VibeThemes. Versions through 4.970 are affected. The record names no fixed version, so check the vendor changelog and Patchstack before relying on an update.
What's affected
WPLMS versions through 4.970, per the record and the Patchstack entry.
The record does not name a fixed version. Check the Patchstack page and the theme vendor's changelog for the current patched release before you rely on an update.
Both active and inactive installs matter, since the theme files remain on disk.
How to check if you're exposed
Use WP-CLI on each WordPress site, or look at Appearance, Themes in the dashboard.
wp theme list --fields=name,status,version
wp theme get wplms --fields=name,version,status
Look at the version column for WPLMS. The record covers versions through 4.970. Check inactive installs too, because a theme that is installed but not active can still have its files reachable on the server.
What to do now
- Run wp theme list on every site and find WPLMS.
- Update to the vendor's latest release, and confirm in its changelog or on the Patchstack page that it addresses this issue.
- If the theme is not in use, delete it. If it is in use and no patched release exists, plan a switch to a maintained theme.
- Review web server logs for unusual requests to theme files, and keep a recent backup of the site and database.
- Review your logs for requests to the affected area from accounts or addresses that do not normally use it.
- Test with a low privilege account after patching to confirm the restriction now holds.
Why it matters
Missing authorization means an action runs without a check on who is asking. The record describes exploiting incorrectly configured access control security levels. The CVSS vector requires a low privilege account and shows a limited integrity impact, so a logged in user, such as a student account, could do something they should not.
Learning sites often allow open registration, which makes a low privilege requirement easy to meet. Review what ordinary accounts can do on your site.
The record classifies the weakness as CWE-862 (Missing Authorization).
Access control bugs are quiet. Nothing crashes and no error appears, because the application does exactly what the request asked. The flaw is that the server never asked whether the caller was allowed to ask.
The durable fix is to check authorization on the server for every action, tied to the identity of the caller, and never to rely on what the browser interface chooses to show. Reviewing a few sensitive endpoints with a second account of lower privilege is a cheap way to find this class of problem before someone else does.
The record shows this CVE is not in the CISA Known Exploited Vulnerabilities catalog.
Quick check
Is there a fixed version of WPLMS?
The record lists versions through 4.970 as affected and gives no fixed version. Check the Patchstack page and the vendor changelog.
Does deleting an inactive WPLMS install help?
Yes. An inactive theme still has files on disk, so removing it removes the exposure.
Sources
Last reviewed: 18 October 2026.
