CVE-2025-60143: Netgsm Authorization Bypass Vulnerability

CVE-2025-60143 Overview

CVE-2025-60143 is a missing authorization vulnerability affecting the Netgsm WordPress plugin developed by netgsm. The flaw stems from incorrectly configured access control security levels that allow authenticated users with low privileges to invoke plugin functionality reserved for higher-privileged roles. The vulnerability affects all Netgsm plugin versions up to and including 2.9.69.

Critical Impact
An authenticated attacker with low privileges can bypass access control checks over the network and modify data exposed by the Netgsm plugin without user interaction.

Affected Products

Netgsm WordPress plugin versions from n/a through <= 2.9.69
WordPress installations with the netgsm plugin enabled
Sites using the plugin for SMS integration and messaging workflows

Discovery Timeline

2025-09-26 - CVE-2025-60143 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-60143

Vulnerability Analysis

The vulnerability is classified as Missing Authorization under CWE-862. The Netgsm plugin exposes actions that do not verify the calling user's role or capability before executing sensitive operations. As a result, users authenticated at a low privilege level can reach functionality intended for administrators or other elevated roles.

Exploitation requires network access to the WordPress site and a valid low-privilege account. No user interaction is needed, and the attack complexity is low. The impact is limited to integrity of data managed by the plugin; confidentiality and availability are not directly affected according to the published metrics.

Because the flaw resides in server-side authorization logic, standard perimeter controls such as web application firewalls provide limited protection unless tuned to inspect specific plugin endpoints and request parameters.

Root Cause

The root cause is an incorrectly configured access control security level within the plugin's request handlers. Callable actions rely on the presence of an authenticated session rather than a capability check such as current_user_can(). This design gap allows any authenticated user, including subscriber-level accounts, to reach protected operations.

Attack Vector

The attack vector is network based over HTTP or HTTPS to the WordPress admin-ajax or REST endpoints exposed by the plugin. An attacker authenticates with any valid account, then sends a crafted request to a plugin action that lacks a capability check. The server processes the request as if the caller were authorized, producing an integrity impact on plugin-managed data.

For endpoint-specific details and reproduction context, see the Patchstack Vulnerability Report.

Detection Methods for CVE-2025-60143

Indicators of Compromise

Requests to Netgsm plugin AJAX or REST endpoints originating from accounts with low-privilege roles such as subscriber or customer
Unexpected changes to Netgsm plugin configuration, message templates, or SMS-related settings
Outbound SMS activity, API calls, or credential usage initiated outside of administrator sessions

Detection Strategies

Enable WordPress audit logging to capture plugin action invocations along with the authenticated user role
Review web server access logs for admin-ajax.php and REST calls targeting Netgsm actions from non-administrative sessions
Correlate authentication events with plugin configuration changes to identify privilege mismatches

Monitoring Recommendations

Alert on any modification of Netgsm plugin settings performed by non-administrator accounts
Monitor for anomalous volumes of requests to plugin endpoints from a single authenticated session
Track newly registered low-privilege accounts followed shortly by requests to plugin actions

How to Mitigate CVE-2025-60143

Immediate Actions Required

Update the Netgsm plugin to a version later than 2.9.69 once the vendor publishes a fix
Restrict new user registration on WordPress sites where the plugin is installed until patched
Audit existing low-privilege accounts and remove unused or suspicious users
Rotate any Netgsm API credentials stored in the plugin configuration if unauthorized access is suspected

Patch Information

The CVE record identifies affected versions up to and including 2.9.69 and does not list a fixed version in the published data. Administrators should consult the Patchstack Vulnerability Report and the plugin's official update channel for the current fixed release before deploying.

Workarounds

Disable the Netgsm plugin on affected sites until a patched release is installed
Apply a virtual patch at the web application firewall to block low-privilege access to Netgsm AJAX and REST actions
Enforce least privilege on WordPress roles and remove capabilities from custom roles that are not required

bash

# Configuration example: temporarily disable the plugin via WP-CLI
wp plugin deactivate netgsm
wp plugin status netgsm