CVE-2025-60130 Overview
CVE-2025-60130 is a Missing Authorization vulnerability [CWE-862] in the WEDOS Global (wgpwpp) WordPress plugin from wedos.com. The flaw allows unauthenticated attackers to access plugin functionality that is not properly constrained by access control lists (ACLs). Affected versions include WEDOS Global through 1.2.2. Successful exploitation can lead to limited integrity impact on affected WordPress installations without requiring authentication or user interaction.
Critical Impact
Unauthenticated network attackers can invoke plugin functions that should be restricted, resulting in broken access control on WordPress sites running WEDOS Global wgpwpp versions up to and including 1.2.2.
Affected Products
- WEDOS Global (wgpwpp) WordPress plugin — all versions up to and including 1.2.2
- WordPress sites with the WEDOS Global plugin installed and activated
- wedos.com hosting integrations relying on the wgpwpp plugin
Discovery Timeline
- 2025-09-26 - CVE-2025-60130 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-60130
Vulnerability Analysis
The vulnerability is a Broken Access Control issue in the WEDOS Global WordPress plugin. The plugin exposes functionality that lacks proper authorization checks, allowing callers without valid privileges to reach code paths intended for authorized users. Because the attack vector is network-based and requires no authentication or user interaction, any remote actor able to reach the WordPress site can invoke the affected endpoints. The impact is limited to integrity, meaning attackers can alter certain plugin-controlled state or actions but cannot directly read confidential data or crash the service through this flaw alone.
Root Cause
The root cause is a missing authorization check [CWE-862] on one or more plugin handlers. WordPress plugins typically enforce access control using current_user_can() capability checks and nonce verification via check_ajax_referer() or wp_verify_nonce(). In WEDOS Global versions up to 1.2.2, the affected handler paths omit or improperly implement these checks, so the server processes requests regardless of the caller's role or session state.
Attack Vector
An attacker sends crafted HTTP requests to the WordPress site targeting exposed plugin actions such as admin-ajax.php handlers or REST endpoints registered by wgpwpp. Because no capability check gates the handler, the plugin executes the requested operation. Exploitation requires only network reachability to the target site and knowledge of the vulnerable action name. Refer to the Patchstack Vulnerability Database Entry for the specific endpoint disclosure.
Detection Methods for CVE-2025-60130
Indicators of Compromise
- Unexpected HTTP POST or GET requests to admin-ajax.php referencing wgpwpp action names from unauthenticated sessions
- Modifications to plugin-controlled WordPress options or settings without a corresponding administrator login event
- Access log entries showing repeated requests to WEDOS Global REST routes from a single external IP address
Detection Strategies
- Inventory WordPress installations and identify sites running the WEDOS Global (wgpwpp) plugin at version 1.2.2 or earlier
- Review web server access logs for requests to plugin endpoints originating from unauthenticated clients
- Correlate WordPress audit logs with web traffic to identify state changes not tied to a valid admin session
Monitoring Recommendations
- Enable a WordPress audit logging plugin to record option changes, user role modifications, and plugin setting updates
- Deploy a web application firewall rule that blocks unauthenticated access to wgpwpp action handlers
- Alert on anomalous request volume to admin-ajax.php and REST namespaces registered by the plugin
How to Mitigate CVE-2025-60130
Immediate Actions Required
- Update the WEDOS Global plugin to a version later than 1.2.2 as soon as a patched release is available from the vendor
- Disable and remove the wgpwpp plugin on sites where the functionality is not required until a fixed version is installed
- Restrict access to the WordPress admin surface and admin-ajax.php using IP allowlists or WAF rules where feasible
Patch Information
At the time of publication, remediation guidance is tracked through the Patchstack Vulnerability Database Entry. Site administrators should monitor the WordPress plugin repository and vendor advisories from wedos.com for a release above version 1.2.2 that introduces proper capability and nonce checks on the affected handlers.
Workarounds
- Deploy a virtual patch via a web application firewall to reject unauthenticated requests targeting wgpwpp endpoints
- Temporarily deactivate the WEDOS Global plugin until an official fix is applied
- Enforce authentication requirements on admin-ajax.php at the reverse proxy or WAF layer for non-public actions
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
