CVE-2025-60123: 
WordPress vulnerability analysis and mitigation

CVE-2025-60123 is a Missing Authorization vulnerability in the HivePress Claim Listings WordPress plugin (hivepress-claim-listings) that allows authenticated attackers with low privileges to exploit incorrectly configured access control security levels. It affects all versions of the plugin through 1.1.3. The vulnerability was published on September 26, 2025, and was assigned by Patchstack. It carries a CVSS v3.1 base score of 4.3 (Medium) (Red Hat CVE, Patchstack).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether a requesting user has the necessary permissions before performing certain actions. The attack vector is network-based, requires low privileges (authenticated user), low attack complexity, and no user interaction. An attacker with a basic authenticated account on the WordPress site can exploit this broken access control to perform unauthorized actions that should be restricted to higher-privileged roles (Red Hat CVE, Patchstack).

Successful exploitation results in a limited integrity impact — an authenticated low-privileged attacker can perform unauthorized modifications within the scope of the plugin's functionality, such as manipulating listing claim data or states that should be restricted to higher-privileged users. There is no confidentiality or availability impact based on the CVSS assessment. The scope is unchanged, meaning the impact is contained to the vulnerable component and does not facilitate direct lateral movement or system-level compromise (Red Hat CVE).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for CVE-2025-60123. The EPSS score is approximately 0.026%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Red Hat CVE).

Users should update the HivePress Claim Listings plugin to a version beyond 1.1.3 that addresses this access control flaw. Until a patched version is available or applied, site administrators should consider disabling the plugin if listing claim functionality is not critical. Additionally, restricting user registration and limiting the number of low-privileged accounts on the WordPress site can reduce the attack surface (Patchstack).