CVE-2025-60114 Overview
CVE-2025-60114 is a code injection vulnerability in the YayCommerce YayCurrency WordPress plugin. The flaw affects all versions up to and including 3.3.1. It is classified under CWE-94, Improper Control of Generation of Code.
An attacker with high-privilege access can inject and execute arbitrary code on the WordPress server. Successful exploitation results in remote code execution (RCE) on the hosting environment. The vulnerability has a scope change, meaning exploitation can impact resources beyond the vulnerable component.
Critical Impact
Authenticated attackers with elevated WordPress privileges can achieve remote code execution on sites running the YayCurrency plugin, enabling full site compromise and lateral movement within the hosting infrastructure.
Affected Products
- YayCommerce YayCurrency plugin for WordPress
- All versions from initial release through 3.3.1
- WordPress sites with the YayCurrency plugin installed and activated
Discovery Timeline
- 2025-09-26 - CVE-2025-60114 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-60114
Vulnerability Analysis
The vulnerability resides in the YayCurrency plugin's handling of input that is subsequently used in dynamic code generation. The plugin fails to properly sanitize or validate input before passing it to a code evaluation context. This allows an attacker to inject PHP code that the server interprets and executes.
Exploitation requires authenticated access with high privileges on the target WordPress site. Once an attacker reaches the vulnerable code path, injected payloads run with the privileges of the web server process. The impact extends beyond the plugin boundary, affecting the broader WordPress installation and underlying host.
For additional technical context, see the Patchstack YayCurrency Plugin RCE Vulnerability advisory.
Root Cause
The root cause is improper control of code generation, categorized as [CWE-94]. The plugin accepts user-controllable input and incorporates it into a context where PHP code is dynamically constructed and executed. Without strict input validation or avoidance of dynamic evaluation functions, attacker-supplied strings become executable code at runtime.
Attack Vector
The attack vector is network-based through the WordPress administrative interface. An attacker must first obtain high-privilege credentials, such as those of an administrator or similar role with access to the plugin's configuration endpoints. The attacker then submits a crafted request containing a malicious payload to the vulnerable code generation routine. The server processes the payload and executes the injected code within the PHP runtime.
No authenticated code examples or public proof-of-concept exploits are available at this time. Refer to the Patchstack advisory for additional details.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2025-60114
Indicators of Compromise
- Unexpected PHP files written to the WordPress uploads, plugins, or themes directories
- Outbound network connections from the web server process to unknown hosts
- Modifications to YayCurrency plugin configuration options stored in the wp_options table
- Administrator-level requests to YayCurrency endpoints that include serialized PHP or script content
Detection Strategies
- Monitor WordPress audit logs for configuration changes performed by administrator accounts against the YayCurrency plugin
- Inspect web server access logs for POST requests to YayCurrency administrative endpoints containing suspicious characters such as eval, system, backticks, or base64-encoded blobs
- Deploy file integrity monitoring on the WordPress document root to detect new or modified PHP files
Monitoring Recommendations
- Enable PHP error and audit logging to capture dynamic code evaluation events
- Alert on wp-admin requests originating from unusual geolocations or IP ranges for privileged accounts
- Correlate web server process child executions, such as /bin/sh or curl, with preceding HTTP requests to the vulnerable plugin
How to Mitigate CVE-2025-60114
Immediate Actions Required
- Update the YayCurrency plugin to a version released after 3.3.1 that addresses this vulnerability
- Audit all WordPress administrator and high-privilege accounts and rotate credentials where compromise is suspected
- Enforce multi-factor authentication for all administrative WordPress accounts to raise the bar for exploitation
- Review web server logs for signs of exploitation attempts against YayCurrency endpoints
Patch Information
Review the Patchstack YayCurrency advisory for vendor patch details and the fixed version. Apply the vendor-supplied update through the WordPress plugin manager or via WP-CLI as soon as it is available in the target environment.
Workarounds
- Deactivate and remove the YayCurrency plugin until a patched version is installed
- Restrict access to wp-admin using IP allowlisting at the web server or WAF layer
- Apply a web application firewall rule to block requests containing PHP code constructs targeting YayCurrency endpoints
- Enforce the principle of least privilege by limiting the number of accounts with administrator role
# Example: deactivate the vulnerable plugin using WP-CLI
wp plugin deactivate yaycurrency
wp plugin uninstall yaycurrency
# Example: update to the patched version once available
wp plugin update yaycurrency
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
