CVE-2025-60152: 
WordPress vulnerability analysis and mitigation

CVE-2025-60152 is a Missing Authorization (Broken Access Control) vulnerability in the WordPress plugin "Subscribe To Unlock" by wpshuffle, affecting all versions up to and including 1.1.5. The flaw allows authenticated attackers with low privileges (Subscriber-level) to exploit incorrectly configured access control security levels, performing actions beyond their intended permissions. It was reported by João Pedro S Alcântara (Kinorth) on June 6, 2025, and publicly disclosed on September 26, 2025. The vulnerability carries a CVSS v3.1 base score of 4.3 (Medium) (Patchstack, Red Hat CVE).

The root cause is classified as CWE-862 (Missing Authorization), corresponding to OWASP Top 10 category A1: Broken Access Control. The vulnerability arises from the absence of proper authorization, authentication, or nonce token checks on one or more plugin functions, allowing a low-privileged authenticated user (Subscriber role) to invoke functionality intended for higher-privileged roles. Exploitation occurs over the network with low attack complexity and requires no user interaction, making it straightforward for any authenticated WordPress user to abuse (Patchstack).

Successful exploitation results in a low integrity impact — an authenticated low-privileged user can perform unauthorized actions within the plugin that should be restricted to higher-privileged roles. There is no direct confidentiality or availability impact. While the individual impact is limited, Patchstack notes that vulnerabilities of this class are frequently used in mass-exploit campaigns targeting thousands of WordPress sites simultaneously, regardless of site size or popularity (Patchstack).

No public proof-of-concept exploit code has been identified for this vulnerability. The EPSS score is approximately 0.026%, indicating a very low probability of exploitation in the near term. There is no evidence of in-the-wild exploitation or threat actor attribution at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack classifies this as low priority with unlikely exploitation impact (Patchstack, Red Hat CVE).

As of the disclosure date (September 26, 2025), no official patched version of the Subscribe To Unlock plugin is available from the developer. Site administrators should remove or deactivate the plugin until a fix is released. If removal is not feasible, restricting user registration or limiting Subscriber-level accounts on the WordPress site can reduce exposure. Monitoring for unexpected plugin configuration changes may also help detect abuse (Patchstack).

The vulnerability was discovered and disclosed by Patchstack, credited to researcher João Pedro S Alcântara (Kinorth). Patchstack classifies it as low priority with no impactful threat, noting the absence of an official patch. No significant vendor statements, broader media coverage, or notable community discussion have been identified beyond the initial Patchstack advisory (Patchstack).