CVE-2025-60077: 
WordPress vulnerability analysis and mitigation

CVE-2025-60077 is a Missing Authorization (Broken Access Control) vulnerability in the YayCommerce YayPricing WordPress plugin that allows unauthenticated remote attackers to access functionality not properly constrained by ACLs. It affects YayPricing versions up to and including 3.5.3, with version 3.5.4 containing the fix. The vulnerability was reported by Denver Jackson on July 30, 2025, and published by Patchstack on August 29, 2025. It carries a CVSS v3.1 base score of 7.5 (High) (Patchstack).

The root cause is classified as CWE-862 (Missing Authorization), meaning one or more plugin functions lack proper authorization, authentication, or nonce token checks before execution. This allows an unauthenticated network attacker with no user interaction required to invoke privileged plugin functionality directly via HTTP requests. The attack vector is network-based, with low complexity and no privileges required, making it trivially exploitable against any exposed WordPress site running the vulnerable plugin (Patchstack).

Successful exploitation results in a high confidentiality impact, with no integrity or availability impact reported (CVSS C:H/I:N/A:N). An unauthenticated attacker can access restricted plugin functionality and potentially read sensitive pricing rules, discount configurations, or other data managed by the YayPricing plugin. Patchstack notes that vulnerabilities of this class are commonly used in mass-exploit campaigns targeting thousands of WordPress sites regardless of their traffic or popularity (Patchstack).

No public proof-of-concept exploit code has been identified at this time, and there is no confirmed evidence of active in-the-wild exploitation. The EPSS score is approximately 0.017% (0.000170), indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack classifies it as high priority and warns it is expected to be exploited, consistent with the pattern of mass-exploit campaigns targeting WordPress plugin vulnerabilities (Patchstack).

The vendor has released YayPricing version 3.5.4, which patches this vulnerability. Site administrators should update the YayPricing plugin to version 3.5.4 or later immediately. As an interim measure, Patchstack has issued a virtual patching/mitigation rule for its subscribers to block exploitation attempts until the plugin is updated. If updating is not immediately possible, consider temporarily deactivating the plugin or restricting access to the WordPress admin and REST API endpoints (Patchstack).

Patchstack, which coordinated disclosure and assigned the CVE, classifies this as a high-priority vulnerability and warns of potential mass-exploit campaign usage. The vulnerability was discovered and reported by security researcher Denver Jackson. No significant broader media coverage or notable social media commentary has been identified beyond the Patchstack advisory (Patchstack).