CVE-2025-60121: WooEvents Authorization Bypass Vulnerability

CVE-2025-60121 Overview

CVE-2025-60121 is a Missing Authorization vulnerability in the Ex-Themes WooEvents WordPress plugin. The flaw affects all versions of woo-events up to and including 4.1.7. Attackers can exploit incorrectly configured access control security levels to interact with plugin functionality that should require authorization. The issue is classified under CWE-862: Missing Authorization. The vulnerability is exploitable over the network without authentication or user interaction, though impact is limited to integrity. Patchstack published the advisory for this Broken Access Control issue.

Critical Impact
Unauthenticated network attackers can invoke WooEvents plugin actions that lack proper authorization checks, resulting in limited integrity impact on affected WordPress sites.

Affected Products

Ex-Themes WooEvents plugin for WordPress
WooEvents versions from n/a through 4.1.7
WordPress sites running the woo-events plugin

Discovery Timeline

2025-09-26 - CVE-2025-60121 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-60121

Vulnerability Analysis

CVE-2025-60121 is a Broken Access Control issue in the WooEvents WordPress plugin. The plugin exposes functionality that fails to verify whether the requesting user has the required permission level before executing sensitive actions. This maps directly to CWE-862: Missing Authorization, where the software does not perform an authorization check when an actor attempts to access a resource or perform an action.

Because the flaw is network-reachable and requires no authentication or user interaction, an attacker can send crafted HTTP requests directly to the affected plugin endpoints. The advisory scope indicates limited integrity impact only, without direct confidentiality or availability consequences.

Root Cause

The root cause is an incorrectly configured access control security level within the woo-events plugin. One or more request handlers do not enforce a capability check such as current_user_can() or a valid nonce verification via check_admin_referer() before performing state-changing operations. As a result, the intended trust boundary between anonymous visitors and privileged users is not enforced by the plugin code.

Attack Vector

An unauthenticated remote attacker sends HTTP requests to a vulnerable WordPress endpoint exposed by the plugin, such as an admin-ajax.php action or a REST route registered by woo-events. Because the handler skips authorization enforcement, the attacker's request executes with the privileges the handler assumes. The EPSS score for this CVE is 0.254%, placing it in the 16.9th percentile. No public proof-of-concept, exploit database entry, or CISA KEV listing is currently associated with CVE-2025-60121. Refer to the Patchstack advisory for further technical details.

Detection Methods for CVE-2025-60121

Indicators of Compromise

Unauthenticated HTTP POST requests to admin-ajax.php referencing WooEvents actions.
Unexpected modifications to event posts, taxonomies, or plugin settings created by the woo-events plugin.
Access log entries showing repeated requests to WooEvents REST routes from a single IP without a valid session cookie.

Detection Strategies

Inventory all WordPress installations and identify sites running the woo-events plugin at version 4.1.7 or earlier.
Review web server access logs for requests hitting WooEvents endpoints without an authenticated wordpress_logged_in_* cookie.
Correlate WordPress audit log events with plugin activity to identify state changes that occurred without a corresponding user login.

Monitoring Recommendations

Deploy a web application firewall rule that alerts on anonymous requests to WooEvents AJAX actions and REST routes.
Monitor for anomalous creation, modification, or deletion of WooEvents-managed posts and metadata.
Enable WordPress activity logging to capture the actor, IP, and payload for each plugin-triggered action.

How to Mitigate CVE-2025-60121

Immediate Actions Required

Update WooEvents to a version later than 4.1.7 once a patched release is available from Ex-Themes.
If no fixed release is yet available, deactivate and remove the woo-events plugin from production sites.
Audit recent WooEvents-related changes and revert any unauthorized modifications.

Patch Information

Refer to the Patchstack advisory for WooEvents 4.1.7 Broken Access Control for vendor patch status. Apply the fixed plugin version through the WordPress plugin manager or via WP-CLI once released by Ex-Themes.

Workarounds

Restrict access to /wp-admin/admin-ajax.php and WooEvents REST routes at the web application firewall for unauthenticated clients where feasible.
Apply a virtual patch through a WAF signature that blocks anonymous requests to WooEvents action names.
Limit administrative access to the WordPress site by IP allowlisting until a vendor patch is installed.

bash

# Configuration example: update WooEvents via WP-CLI once a patched version is published
wp plugin update woo-events --version=<patched-version>
wp plugin list --name=woo-events --fields=name,status,version