CVE-2025-60068: 
WordPress vulnerability analysis and mitigation

CVE-2025-60068 is a Code Injection (Arbitrary Code Execution) vulnerability in the Javo Core WordPress plugin by javothemes, classified under CWE-94 (Improper Control of Generation of Code). It affects all versions of Javo Core up to and including 3.0.0.266, and can be exploited by unauthenticated remote attackers. The vulnerability was reported on July 4, 2025, by researcher Trương Hữu Phúc (truonghuuphuc) and published by Patchstack on August 3, 2025. It carries a CVSS v3.1 base score of 6.5 (Medium/High), though Patchstack rates it as High priority due to its unauthenticated exploitability and mass-exploit campaign potential (Patchstack).

The vulnerability is rooted in improper control of code generation (CWE-94), allowing user-supplied input to be interpreted and executed as code on the server. The attack vector is network-based, requires no authentication and no user interaction, and has low attack complexity, making it trivially exploitable by remote attackers. Exploitation aligns with CAPEC-242 (Code Injection) and CAPEC-77 (Manipulating User-Controlled Variables), suggesting that attacker-controlled variables are passed unsanitized into a code execution context within the plugin. No official patch has been released as of the publication date, and no detailed public technical write-up or PoC code has been disclosed (Patchstack).

Successful exploitation allows a remote, unauthenticated attacker to execute arbitrary code on the WordPress server hosting the vulnerable Javo Core plugin, resulting in low confidentiality and integrity impacts per the CVSS scoring. In practice, arbitrary code execution on a WordPress site can lead to full site compromise, including defacement, data theft, installation of backdoors or web shells, and use of the server as a pivot point for further attacks. The vulnerability is considered suitable for mass-exploit campaigns targeting large numbers of WordPress sites regardless of their size or traffic (Patchstack).

No official patch is currently available, and Patchstack explicitly notes this vulnerability is "highly dangerous and expected to become exploited" and is the type used in mass-exploit campaigns. The EPSS score is approximately 0.029% (0.000290), indicating a currently low but non-zero probability of exploitation in the near term. No confirmed in-the-wild exploitation, threat actor attribution, or CISA KEV catalog listing has been reported at this time. Patchstack has issued a virtual patching/mitigation rule for its subscribers to block attacks until an official fix is released (Patchstack).

As of the publication date, no official patch has been released by the Javo Core plugin developer (javothemes). Site administrators are advised to deactivate and remove the Javo Core plugin until a patched version becomes available. Patchstack users benefit from an automatically applied virtual patch/mitigation rule that blocks exploitation attempts. If removal is not feasible, consult your hosting provider or web developer for assistance, and consider implementing a Web Application Firewall (WAF) rule to block suspicious requests targeting the plugin (Patchstack).

Patchstack, the assigning CNA, has rated this vulnerability as High priority and flagged it as likely to be used in mass-exploit campaigns against WordPress sites. No notable vendor statements from javothemes, broader media coverage, or significant researcher commentary beyond the Patchstack disclosure have been identified at this time (Patchstack).