CVE-2025-60103: 
WordPress vulnerability analysis and mitigation

CVE-2025-60103 is a Missing Authorization (Broken Access Control) vulnerability in the CridioStudio ListingPro WordPress plugin. It allows authenticated attackers with low-level privileges to exploit incorrectly configured access control security levels. The vulnerability affects ListingPro versions up to and including 2.9.8. It was published on September 26, 2025, and carries a CVSS v3.1 base score of 5.4 (Medium) (Feedly, Patchstack).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether an authenticated user has the appropriate permissions before executing certain actions. The attack vector is network-based, requires low privileges (authenticated user), no user interaction, and low attack complexity, making it straightforward to exploit for any registered user on an affected WordPress site. The vulnerability was discovered and reported by Patchstack, which assigned it EUVD-2025-31297 (Patchstack, Feedly).

Successful exploitation allows a low-privileged authenticated attacker to perform unauthorized actions on the affected WordPress site, resulting in limited integrity and availability impacts. Confidentiality is not directly impacted according to the CVSS scoring. The scope is limited to the affected system, but unauthorized modifications to listings or plugin data could disrupt site operations or allow manipulation of directory content managed by ListingPro (Feedly, Patchstack).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for CVE-2025-60103. The EPSS score is approximately 0.036%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Feedly).

Users should update the ListingPro plugin to a version beyond 2.9.8 as soon as a patched release is made available by CridioStudio. In the interim, site administrators should restrict plugin access to trusted users only and review user role assignments to minimize the number of low-privileged accounts. Monitoring WordPress activity logs for unexpected actions performed by subscriber or contributor-level accounts may help detect potential abuse (Patchstack).