CVE-2025-60079: 
WordPress vulnerability analysis and mitigation

CVE-2025-60079 is a Missing Authorization vulnerability in the bPlugins Parallax Section Block WordPress plugin that allows authenticated attackers with low privileges to access functionality not properly constrained by ACLs. It affects all versions of the plugin from n/a through 1.0.9. The vulnerability was published on December 18, 2025, and was assigned by Patchstack. It carries a CVSS v3.1 base score of 7.1 (High) (Feedly).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether a requesting user has the necessary permissions before granting access to certain functionality. The attack vector is network-based, requires low privileges (an authenticated WordPress user), low attack complexity, and no user interaction. The specific unprotected functionality allows an attacker to perform actions that should be restricted, potentially modifying plugin settings or disrupting availability (Feedly).

Successful exploitation can result in low integrity impact (e.g., unauthorized modification of plugin-controlled content or settings) and high availability impact, potentially disrupting the affected WordPress site's functionality. Confidentiality is not directly impacted according to the CVSS scoring. The scope is limited to the affected system without lateral movement beyond the WordPress installation (Feedly).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-60079. The EPSS score is approximately 0.017%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum a low-privileged authenticated account on the target WordPress site (Feedly).

Users should update the Parallax Section Block plugin to a version beyond 1.0.9 if a patched release is available from bPlugins. If no patch is yet available, site administrators should consider deactivating or removing the plugin until a fix is released. Restricting WordPress user registrations and limiting low-privilege accounts can reduce the attack surface in the interim (Feedly).