CVE-2025-60094: 
WordPress vulnerability analysis and mitigation

CVE-2025-60094 is a Missing Authorization (Broken Access Control) vulnerability in the Stackable – Page Builder Gutenberg Blocks WordPress plugin by Benjamin Intal. It affects all versions from n/a through 3.18.1 and allows authenticated attackers with low-level privileges to exploit incorrectly configured access control security levels. The vulnerability was published on September 26, 2025, and carries a CVSS v3.1 base score of 4.3 (Medium) (Feedly, Patchstack).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether an authenticated user has the appropriate permissions before executing certain actions or accessing certain functionality. The attack vector is network-based, requires low privileges (authenticated user), and no user interaction, making it straightforward to exploit from any authenticated WordPress account. The vulnerability falls under the CAPEC pattern of exploiting incorrectly configured access control security levels (Feedly).

Successful exploitation allows a low-privileged authenticated attacker to perform unauthorized actions that should be restricted to higher-privileged roles, resulting in a low integrity impact with no confidentiality or availability impact. The scope is limited to the affected WordPress installation, but could allow attackers to modify plugin settings or content in ways not intended for their role. Lateral movement potential is limited, though unauthorized modifications could be leveraged to further compromise site content or configuration (Feedly).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for CVE-2025-60094. The EPSS score is approximately 0.026% (0.000260), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been identified (Feedly).

Users should update the Stackable – Page Builder Gutenberg Blocks plugin to a version beyond 3.18.1, as all versions up to and including 3.18.1 are affected. The fix was reported by Patchstack, and site administrators should apply the update via the WordPress plugin dashboard as soon as a patched release is available. As a temporary workaround, restricting plugin access to trusted administrator accounts only and auditing user roles can reduce exposure (Patchstack).