CVE-2025-60119: CoSchedule Information Disclosure Flaw

CVE-2025-60119 Overview

CVE-2025-60119 is a sensitive data exposure vulnerability in the CoSchedule coschedule-by-todaymade WordPress plugin. The flaw is categorized as Exposure of Sensitive System Information to an Unauthorized Control Sphere [CWE-497]. It allows unauthenticated remote attackers to retrieve embedded sensitive data from vulnerable installations. The vulnerability affects all plugin versions up to and including 3.3.11. Attackers can query exposed endpoints over the network without authentication or user interaction. Successful exploitation results in confidentiality impact only, with no direct effect on integrity or availability.

Critical Impact
Unauthenticated network attackers can retrieve embedded sensitive information from WordPress sites running the CoSchedule plugin, exposing configuration or system data that supports follow-on attacks.

Affected Products

CoSchedule coschedule-by-todaymade WordPress plugin
All versions up to and including 3.3.11
WordPress deployments with the plugin activated

Discovery Timeline

2025-09-26 - CVE-2025-60119 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-60119

Vulnerability Analysis

The vulnerability stems from improper protection of embedded sensitive information within the CoSchedule plugin. The plugin exposes system or configuration data to unauthorized callers through network-accessible resources. Because no authentication is required, any remote client can request the affected endpoints and read the data returned. The impact is scoped to information disclosure. Attackers do not gain code execution or write access through this flaw alone. However, disclosed data — such as internal identifiers, tokens, or configuration values — can enable reconnaissance, credential misuse, or chained attacks against the WordPress site.

The EPSS score for this issue is approximately 0.285%, indicating a low current probability of observed exploitation activity. No public proof-of-concept, exploit code, or CISA KEV entry is associated with CVE-2025-60119 at the time of publication.

Root Cause

The root cause is a missing access control boundary around data that the plugin embeds or returns during normal operation. The CWE-497 classification indicates that sensitive system information is reachable by a control sphere that should not have access. The plugin does not enforce a capability check, nonce, or authenticated context before returning the affected data. Refer to the Patchstack Vulnerability Report for the specific affected code paths.

Attack Vector

Exploitation requires only network access to the target WordPress site. An attacker issues HTTP requests to the exposed plugin resource and parses the response for embedded sensitive values. No credentials, session, or user interaction is required. Automation of the request against internet-facing WordPress installations is straightforward, making mass reconnaissance feasible for opportunistic actors.

See the Patchstack Vulnerability Report for technical details on the affected requests.

Detection Methods for CVE-2025-60119

Indicators of Compromise

Unauthenticated HTTP GET requests to CoSchedule plugin endpoints under /wp-content/plugins/coschedule-by-todaymade/ from external IP ranges.
Anomalous request volume against wp-admin/admin-ajax.php referencing CoSchedule actions from unfamiliar user agents.
Web server access logs showing repeated 200 responses to plugin resources from scanning infrastructure.

Detection Strategies

Inventory WordPress hosts and identify installations running coschedule-by-todaymade at version 3.3.11 or earlier using plugin version scans.
Alert on unauthenticated requests to CoSchedule plugin paths that return non-empty responses containing configuration keys or identifiers.
Correlate reconnaissance patterns targeting WordPress plugin directories with subsequent authenticated actions against the same site.

Monitoring Recommendations

Forward web server access logs and WordPress audit logs to a centralized analytics platform for correlation.
Monitor egress of sensitive strings — API keys, tokens, internal hostnames — from WordPress hosts in HTTP responses.
Track plugin version drift so that outdated CoSchedule installations are flagged during routine vulnerability scans.

How to Mitigate CVE-2025-60119

Immediate Actions Required

Update the CoSchedule coschedule-by-todaymade plugin to a version later than 3.3.11 as soon as the vendor publishes a fixed release.
Audit any credentials, tokens, or configuration values that the plugin may have exposed and rotate them.
Restrict access to WordPress plugin directories from untrusted networks using web application firewall rules.

Patch Information

Refer to the Patchstack Vulnerability Report for the current patch status. Administrators should apply the vendor-provided update through the WordPress plugin management interface once available and verify the installed version is above 3.3.11.

Workarounds

Deactivate and remove the CoSchedule plugin until a fixed version is installed if the functionality is not business-critical.
Deploy WAF rules that block unauthenticated requests to the specific CoSchedule endpoints identified in the Patchstack advisory.
Restrict access to /wp-content/plugins/coschedule-by-todaymade/ at the reverse proxy layer to trusted IP ranges only.

bash

# Example nginx rule to restrict access to the CoSchedule plugin directory
location ^~ /wp-content/plugins/coschedule-by-todaymade/ {
    allow 10.0.0.0/8;
    deny all;
}