CVE-2025-60128: Delisho WordPress Plugin Auth Bypass Flaw

CVE-2025-60128 Overview

CVE-2025-60128 is a Missing Authorization vulnerability in the WP Delicious Delisho plugin (dr-widgets-blocks) for WordPress. The flaw affects Delisho versions up to and including 1.1.3 and stems from incorrectly configured access control security levels [CWE-862]. Authenticated users with low privileges can invoke plugin functionality that should require elevated permissions. The vulnerability was published to the National Vulnerability Database (NVD) on September 26, 2025, and cataloged via a Patchstack advisory.

Critical Impact
Authenticated attackers with low-level privileges can bypass authorization checks in the Delisho plugin, resulting in limited integrity impact on affected WordPress sites.

Affected Products

WP Delicious Delisho plugin (dr-widgets-blocks)
Delisho versions from n/a through <= 1.1.3
WordPress installations running the vulnerable plugin

Discovery Timeline

2025-09-26 - CVE-2025-60128 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-60128

Vulnerability Analysis

The Delisho plugin exposes functionality through its dr-widgets-blocks component without enforcing appropriate authorization checks. An authenticated user, including a subscriber-level account, can reach endpoints that should be restricted to higher-privileged roles such as editor or administrator. The issue is classified under [CWE-862] Missing Authorization, indicating that the application performs an action without verifying that the requester holds the required capability.

Exploitation requires network access to the WordPress site and a valid low-privilege account. No user interaction is needed beyond issuing the crafted request. The impact is limited to integrity, with no direct effect on confidentiality or availability of the underlying system.

Root Cause

The root cause is the absence of capability checks (current_user_can()) or nonce verification on one or more plugin actions handled by dr-widgets-blocks. WordPress plugins are expected to gate privileged operations behind role-based checks. Delisho releases up to 1.1.3 omit these checks on affected handlers, leaving them reachable by any authenticated session.

Attack Vector

An attacker with an authenticated WordPress account sends an HTTP request to the vulnerable plugin endpoint. Because the handler does not validate the caller's role or capabilities, the action executes under the attacker's session. Refer to the Patchstack Vulnerability Report for technical details on the affected endpoint.

Detection Methods for CVE-2025-60128

Indicators of Compromise

Unexpected changes to Delisho widget or block configurations made by non-administrator accounts
HTTP requests to admin-ajax.php or REST routes associated with dr-widgets-blocks originating from low-privilege user sessions
New or modified widget content that does not correlate with legitimate editor activity

Detection Strategies

Enable WordPress audit logging to record plugin actions and correlate them with user roles
Inspect web server access logs for requests to Delisho plugin endpoints issued by subscriber or contributor accounts
Review plugin inventory to identify WordPress sites running Delisho 1.1.3 or earlier

Monitoring Recommendations

Alert on authenticated requests to plugin endpoints from accounts that should not have administrative capabilities
Monitor WordPress user role assignments for unauthorized escalations following plugin activity
Forward WordPress and web server logs to a centralized SIEM for correlation and long-term retention

How to Mitigate CVE-2025-60128

Immediate Actions Required

Identify all WordPress instances running the Delisho plugin at version 1.1.3 or earlier
Update Delisho to a patched release once available from WP Delicious
Audit existing user accounts and remove unnecessary low-privilege accounts that could be leveraged for exploitation
Review widget and block configurations for unauthorized modifications

Patch Information

At the time of publication, the advisory lists Delisho versions up to <= 1.1.3 as affected. Administrators should consult the Patchstack Vulnerability Report and the WP Delicious plugin page for the latest patched version and upgrade instructions.

Workarounds

Deactivate and remove the Delisho plugin until a patched version is installed
Restrict user registration and disable open sign-ups to reduce the pool of authenticated attackers
Deploy a Web Application Firewall (WAF) rule to block requests to affected dr-widgets-blocks endpoints from non-administrator sessions

bash

# Example: list WordPress sites with the vulnerable plugin using WP-CLI
wp plugin list --name=dr-widgets-blocks --fields=name,status,version

# Deactivate the plugin as a temporary workaround
wp plugin deactivate dr-widgets-blocks