CVE-2025-60086: 
WordPress vulnerability analysis and mitigation

CVE-2025-60086 is a Missing Authorization vulnerability in the WP Voting Contest WordPress plugin (by Matt/ohiowebtech) that allows unauthenticated attackers to exploit incorrectly configured access control security levels. It affects all versions of the plugin from n/a through 5.8. The vulnerability was published on December 18, 2025, and was assigned by Patchstack. It carries a CVSS v3.1 base score of 7.5 (High) (Feedly, Patchstack).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether a requesting user has the necessary permissions before performing sensitive operations. The attack vector is network-based, requires no authentication, no user interaction, and low attack complexity, making it trivially exploitable by any remote attacker. The vulnerability falls under the category of Broken Access Control, where certain plugin endpoints or actions can be triggered without appropriate capability checks (Feedly, Patchstack).

Successful exploitation results in a high integrity impact with no confidentiality or availability impact, meaning attackers can manipulate contest data, votes, or plugin settings without authorization. This could allow an unauthenticated attacker to tamper with voting contest results, add or remove votes fraudulently, or alter plugin configurations on affected WordPress sites. The scope is limited to the affected system, but the integrity compromise could undermine the legitimacy of any contest hosted via the plugin (Feedly).

The vulnerability has a very low EPSS score of approximately 0.017%, indicating limited probability of exploitation in the near term based on current threat intelligence. No evidence of active in-the-wild exploitation, public proof-of-concept code, or threat actor attribution has been reported. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly).

Users of the WP Voting Contest plugin should update to a version beyond 5.8 if a patched release is available from the plugin author (Matt/ohiowebtech). If no patch is yet available, site administrators should consider deactivating or removing the plugin until a fix is released. Additionally, implementing a Web Application Firewall (WAF) with WordPress-specific rules can help block unauthorized access attempts to plugin endpoints (Patchstack).