CVE-2025-60129 Overview
CVE-2025-60129 is a missing authorization vulnerability affecting the Yext WordPress plugin in versions up to and including 1.1.3. The flaw allows unauthenticated attackers to access plugin functionality that should be restricted by access control lists (ACLs). The issue is classified under CWE-862 (Missing Authorization) and stems from broken access control on plugin endpoints. Attackers can reach protected functionality over the network without credentials or user interaction, resulting in limited integrity impact on affected WordPress sites.
Critical Impact
Unauthenticated network attackers can invoke Yext plugin functionality that lacks proper ACL enforcement, enabling limited unauthorized modifications on WordPress sites running versions through 1.1.3.
Affected Products
- Yext WordPress plugin versions up to and including 1.1.3
- WordPress sites with the vulnerable Yext plugin installed and activated
- No fixed version has been published in the referenced advisory at time of writing
Discovery Timeline
- 2025-09-26 - CVE-2025-60129 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-60129
Vulnerability Analysis
The vulnerability is a broken access control issue in the Yext WordPress plugin. The plugin exposes functionality that is not properly gated by capability checks or authorization logic. As a result, requests from unauthenticated users can reach code paths intended for privileged roles. The flaw is remotely exploitable over HTTP without any authentication token or user interaction.
According to the Patchstack WordPress Vulnerability Report, the issue impacts all releases up to 1.1.3. Exploitation produces limited integrity impact, with no direct confidentiality or availability consequences per the published CVSS vector.
Root Cause
The root cause is missing authorization enforcement on one or more plugin request handlers. In WordPress plugins, this typically indicates absent current_user_can() capability checks, missing nonce validation via check_ajax_referer(), or admin-post and REST endpoints registered without a permission_callback that verifies user rights. Without these checks, WordPress dispatches the request to the handler regardless of the caller's identity.
Attack Vector
An unauthenticated attacker sends a crafted HTTP request to a vulnerable plugin endpoint on a target WordPress site. Because the handler does not verify the requester's capabilities, the plugin executes the requested action. No verified proof-of-concept exploit code is publicly available at the time of writing. Refer to the Patchstack advisory for further technical details.
Detection Methods for CVE-2025-60129
Indicators of Compromise
- Unauthenticated HTTP POST or GET requests to Yext plugin endpoints under /wp-admin/admin-ajax.php or /wp-json/ paths
- Unexpected changes to Yext plugin settings or configuration entries in the wp_options table
- Access log entries showing requests to plugin action handlers without a valid authenticated session cookie
Detection Strategies
- Inventory WordPress installations to identify sites running the Yext plugin at version 1.1.3 or earlier
- Review web server access logs for anomalous requests targeting Yext plugin URIs from unauthenticated sources
- Monitor WordPress audit logs for configuration changes originating from unauthenticated or unexpected IP addresses
Monitoring Recommendations
- Deploy a web application firewall (WAF) with rules covering WordPress broken access control patterns
- Enable WordPress activity logging plugins to capture administrative actions and correlate them with authenticated sessions
- Alert on high-frequency requests to admin-ajax.php or REST API endpoints that reference the Yext plugin
How to Mitigate CVE-2025-60129
Immediate Actions Required
- Identify all WordPress sites running the Yext plugin at version 1.1.3 or earlier
- Deactivate and remove the Yext plugin until a patched release is available and verified
- Restrict access to /wp-admin/ and REST API endpoints via IP allowlisting where operationally feasible
- Review WordPress user accounts and audit recent configuration changes for signs of unauthorized activity
Patch Information
At the time of publication, the referenced Patchstack advisory does not list a fixed version. Monitor the vendor and Patchstack database for a security release beyond 1.1.3 and apply it immediately upon availability.
Workarounds
- Disable the Yext plugin on affected WordPress installations until a fix is released
- Apply WAF rules that block unauthenticated requests to Yext plugin action handlers
- Enforce strong administrative access controls and require authentication for all sensitive plugin endpoints via server-level rules
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
