CVE-2025-60103: 
WordPress vulnerability analysis and mitigation

A Missing Authorization vulnerability was discovered in CridioStudio ListingPro plugin versions through 2.9.8. The vulnerability was identified and reported by Rafie Muhammad from Patchstack on August 15, 2025, and was publicly disclosed on September 26, 2025. This security issue was assigned CVE-2025-60103 and affects the WordPress ListingPro plugin (Patchstack).

The vulnerability is classified as a Broken Access Control issue (CWE-862) with a CVSS v3.1 Base Score of 5.4 (Medium). The vulnerability vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, indicating network accessibility, low attack complexity, and required low privileges for exploitation (Patchstack).

The vulnerability allows exploiting incorrectly configured access control security levels, potentially enabling unprivileged users to execute certain higher privileged actions. The impact is considered low to medium, affecting the integrity and availability of the system (Patchstack).

As of the disclosure date, no official fix has been made available for this vulnerability. The security issue has been assessed as having a low severity impact, and virtual patching is considered unnecessary (Patchstack).