CVE-2025-60095: Stackable Plugin Information Disclosure

CVE-2025-60095 Overview

CVE-2025-60095 is a sensitive information disclosure vulnerability in the Stackable Ultimate Gutenberg Blocks WordPress plugin by Benjamin Intal. The flaw affects all plugin versions up to and including 3.18.1. An authenticated attacker with low privileges can retrieve embedded sensitive data through the plugin. The issue is tracked under CWE-201: Insertion of Sensitive Information Into Sent Data. Public technical details are available in the Patchstack Vulnerability Report.

Critical Impact
Authenticated low-privilege users can retrieve sensitive data embedded in plugin responses, exposing information intended to remain private within the WordPress site.

Affected Products

Stackable Ultimate Gutenberg Blocks (stackable-ultimate-gutenberg-blocks) plugin for WordPress
All versions from initial release through 3.18.1
WordPress installations with the plugin active and low-privileged accounts provisioned

Discovery Timeline

2025-09-26 - CVE-2025-60095 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-60095

Vulnerability Analysis

The Stackable plugin embeds sensitive information within data returned to authenticated users. Because access controls on the affected data path do not sufficiently restrict who can read the information, any authenticated user with at least low privileges can retrieve it. The exposure is limited to confidentiality; integrity and availability are not directly impacted. Exploitation requires only network access to the WordPress site and valid credentials for a low-privileged account such as Subscriber or Contributor.

Root Cause

The root cause is classified as CWE-201: Insertion of Sensitive Information Into Sent Data. The plugin includes sensitive fields in data structures that are sent to users whose role should not permit visibility of those fields. The response construction path lacks role-appropriate filtering, so information intended for administrators or editors is disclosed to lower-privileged accounts.

Attack Vector

An attacker authenticates to the target WordPress site using a low-privileged account. The attacker then requests plugin-served content or endpoints that return block data through the Stackable plugin. The response contains sensitive information the account should not be able to read. See the Patchstack advisory for endpoint-level details.

No verified proof-of-concept code is published. The vulnerability manifests in the plugin's data serialization path rather than in a single exploitable payload, so no synthetic exploit is provided here.

Detection Methods for CVE-2025-60095

Indicators of Compromise

Repeated requests from low-privileged accounts to Stackable plugin REST endpoints or block-rendering routes under /wp-json/
Unusual API traffic volume from Subscriber or Contributor accounts targeting plugin data
Access log entries showing authenticated reads of block content that reference restricted post statuses such as private or draft

Detection Strategies

Enable WordPress REST API request logging and correlate requester roles against the sensitivity of returned fields
Compare plugin response payloads across roles in a test environment to identify fields exposed to low-privileged users
Alert on any low-privileged account issuing high volumes of read requests against plugin-registered routes

Monitoring Recommendations

Forward web server and WordPress application logs to a centralized analytics platform for retention and query
Baseline normal read patterns for non-administrative roles and alert on deviation
Track plugin version inventory across managed WordPress sites and flag installations at or below 3.18.1

How to Mitigate CVE-2025-60095

Immediate Actions Required

Upgrade the Stackable plugin to a version later than 3.18.1 once the vendor releases a fix
Audit user accounts and remove or disable unused low-privileged accounts that could be leveraged for authenticated access
Rotate any credentials or secrets that may have been embedded in Stackable blocks or exposed content

Patch Information

At the time of NVD publication, the vulnerability affects all versions through 3.18.1. Consult the Patchstack Vulnerability Report and the plugin's official channels for updated fixed-version information before deploying an upgrade.

Workarounds

Deactivate and remove the Stackable plugin until a patched version is available if the risk of exposure is unacceptable
Restrict user registration and require administrator approval for new accounts to reduce the pool of authenticated attackers
Place the WordPress admin and REST API behind a web application firewall rule set that limits access by source IP or authenticated role
Review Stackable block content for sensitive data and remove embedded secrets, private URLs, or unpublished content references

bash

# Example WP-CLI commands to inventory and disable the plugin
wp plugin get stackable-ultimate-gutenberg-blocks --field=version
wp plugin deactivate stackable-ultimate-gutenberg-blocks
wp user list --role=subscriber --fields=ID,user_login,user_registered