CVE-2025-60094: Stackable Gutenberg Blocks Auth Bypass Flaw

CVE-2025-60094 Overview

CVE-2025-60094 is a missing authorization vulnerability in the Stackable Ultimate Gutenberg Blocks WordPress plugin developed by Benjamin Intal. The flaw affects all versions up to and including 3.18.1. Authenticated attackers with low-privilege accounts can exploit incorrectly configured access control checks to perform actions outside their intended permission scope. The issue is tracked under CWE-862: Missing Authorization.

Critical Impact

Authenticated users with minimal privileges can bypass access control checks in the Stackable plugin, leading to unauthorized modification of plugin data or configuration on affected WordPress sites.

Affected Products

• Benjamin Intal Stackable (stackable-ultimate-gutenberg-blocks) versions through 3.18.1
• WordPress installations using the Stackable Gutenberg block library
• Sites permitting subscriber or contributor-level account registration

Discovery Timeline

• 2025-09-26 - CVE-2025-60094 published to the National Vulnerability Database
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-60094

Vulnerability Analysis

The vulnerability originates from missing authorization checks on one or more plugin endpoints in Stackable Ultimate Gutenberg Blocks. Plugin actions that should be restricted to administrators or editors can be triggered by authenticated users holding lower roles. The plugin registers handlers that verify authentication but fail to validate whether the requesting user has the capability to perform the requested action. This gap allows an attacker holding any authenticated session to invoke privileged plugin functionality.

Exploitation requires network access to the WordPress site and a valid low-privilege account. No user interaction beyond issuing the request is required. Impact is limited to integrity, with no direct effect on confidentiality or availability of the underlying system.

Root Cause

The root cause is an absent or insufficient capability check in the plugin's request handlers. WordPress plugins typically enforce authorization using current_user_can() or nonce and capability pairings inside AJAX and REST endpoints. In Stackable versions through 3.18.1, one or more of these handlers rely on authentication alone. Authorization enforcement is either missing or configured at an incorrect security level, allowing lower-privileged users to reach code paths intended for administrators.

Attack Vector

An attacker registers or obtains a low-privilege WordPress account on a vulnerable site. The attacker then issues a crafted HTTP request to the exposed plugin endpoint. Because the handler does not validate the user's capability, the request is processed and the privileged action is performed. See the Patchstack Vulnerability Report for endpoint-level technical detail.

Detection Methods for CVE-2025-60094

Indicators of Compromise

• Unexpected requests to Stackable plugin AJAX or REST endpoints from subscriber, contributor, or author accounts
• Modification of plugin settings or block configuration without a corresponding administrator session
• Newly created or altered content referencing Stackable block attributes outside normal editorial workflows

Detection Strategies

• Review WordPress access logs for requests to /wp-admin/admin-ajax.php or /wp-json/stackable/* routes originating from non-administrative sessions
• Correlate plugin configuration changes with the acting user's assigned role in the WordPress user database
• Baseline expected callers of Stackable endpoints and alert on deviations

Monitoring Recommendations

• Enable WordPress activity logging to capture role, action, and endpoint metadata for every authenticated request
• Forward web server and application logs to a centralized SIEM for anomaly analysis
• Monitor for creation of new low-privilege accounts followed shortly by Stackable endpoint activity

How to Mitigate CVE-2025-60094

Immediate Actions Required

• Update the Stackable Ultimate Gutenberg Blocks plugin to a version later than 3.18.1 when the vendor releases a fixed release
• Audit existing WordPress user accounts and remove unnecessary low-privilege accounts
• Disable open user registration if it is not required for site operation

Patch Information

At the time of publication, the vulnerability affects Stackable through version 3.18.1. Consult the Patchstack Vulnerability Report and the plugin's official changelog for the fixed version and upgrade instructions.

Workarounds

• Deactivate the Stackable plugin until a patched version is installed if the affected functionality is not business-critical
• Restrict access to /wp-admin/admin-ajax.php and Stackable REST routes at the web application firewall for non-administrator sessions
• Enforce least-privilege role assignment and review capability grants for subscriber, contributor, and author accounts

# Example WAF rule concept: block low-privilege access to Stackable REST namespace
# Adapt to your WAF syntax and validate against legitimate editor traffic
SecRule REQUEST_URI "@beginsWith /wp-json/stackable/" \
  "id:1060094,phase:1,deny,status:403,\
   msg:'Block unauthenticated or low-priv access to Stackable REST endpoints',\
   chain"
  SecRule &REQUEST_HEADERS:Cookie "@eq 0"