CVE-2025-60148: 
WordPress vulnerability analysis and mitigation

CVE-2025-60148 is a Missing Authorization (Broken Access Control) vulnerability in the wpshuffle "Subscribe to Download" WordPress plugin. It affects all versions from n/a through 2.0.9 and was discovered by João Pedro S Alcântara (Kinorth), reported on June 5, 2025, and publicly disclosed on September 26, 2025. The vulnerability carries a CVSS v3.1 base score of 4.3 (Medium) (Patchstack, Red Hat CVE).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify that an authenticated user has the appropriate permissions before executing a privileged action. Specifically, a missing authorization, authentication, or nonce token check in a plugin function allows a low-privileged user (Subscriber-level) to perform actions that should be restricted to higher-privileged roles. The attack vector is network-based, requires low privileges, and no user interaction, making it straightforward to exploit for any authenticated WordPress user (Patchstack).

Successful exploitation allows a low-privileged authenticated attacker (e.g., a Subscriber) to perform unauthorized actions that should be restricted to higher-privileged users, resulting in a low integrity impact. There is no confidentiality or availability impact associated with this vulnerability. The scope is limited to the affected WordPress installation, but in mass-exploit campaigns, attackers may target thousands of sites simultaneously regardless of their size or popularity (Patchstack).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.026% (0.000260), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack rates this as low priority with unlikely exploitation impact, though it notes that broken access control vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress sites (Patchstack).

The vendor has released version 2.1.0 of the Subscribe to Download plugin, which resolves this vulnerability. Site administrators should update the plugin to version 2.1.0 or later immediately. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard. If an immediate update is not possible, site owners should contact their hosting provider or web developer for assistance (Patchstack).