CVE-2025-60155: WP Virtual Assistant Auth Bypass Flaw

CVE-2025-60155 Overview

CVE-2025-60155 is a missing authorization vulnerability in the loopus WP Virtual Assistant (VirtualAssistant) plugin for WordPress. The flaw affects all plugin versions up to and including 3.0. Attackers can exploit incorrectly configured access control security levels to perform actions that should require authentication or elevated privileges. The vulnerability is classified under [CWE-862] Missing Authorization and is exploitable remotely over the network without user interaction or prior authentication.

Critical Impact
Unauthenticated remote attackers can bypass access controls in the WP Virtual Assistant plugin to interact with functionality intended for privileged users, resulting in limited integrity impact on affected WordPress sites.

Affected Products

loopus WP Virtual Assistant (VirtualAssistant) WordPress plugin
All versions from n/a through 3.0
WordPress sites running the vulnerable plugin

Discovery Timeline

2025-09-26 - CVE-2025-60155 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-60155

Vulnerability Analysis

The WP Virtual Assistant plugin exposes functionality without properly verifying the caller's authorization level. The plugin registers endpoints or actions that fail to enforce capability checks before executing sensitive operations. An unauthenticated remote attacker can invoke these endpoints directly by sending crafted HTTP requests to the WordPress site.

The vulnerability aligns with [CWE-862] Missing Authorization, where the application does not perform an authorization check when an actor attempts to access a resource or perform an action. In this plugin, the access control security levels are incorrectly configured, allowing operations to proceed without validating the requester's role or capabilities.

The EPSS score is 0.254%, reflecting current exploitation likelihood telemetry. No public proof-of-concept exploit is documented, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Root Cause

The root cause is the absence of capability checks such as current_user_can() or nonce verification via check_ajax_referer() around plugin actions. Developers registered AJAX handlers or REST routes without restricting them to authenticated users with appropriate roles. This design choice allows any visitor to trigger administrative functionality exposed by the plugin.

Attack Vector

Exploitation requires only network access to the target WordPress site. An attacker crafts HTTP POST or GET requests to the plugin's exposed endpoints, such as admin-ajax.php action handlers or custom REST API routes. Because no authentication or authorization gate exists, the server processes the request and executes the underlying function. See the Patchstack WordPress Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-60155

Indicators of Compromise

Unauthenticated HTTP requests to wp-admin/admin-ajax.php with action parameters tied to the WP Virtual Assistant plugin
Unexpected modifications to plugin-managed data or settings without a corresponding administrator login session
Web server access logs showing repeated requests to plugin-specific endpoints from unauthenticated sources

Detection Strategies

Inventory WordPress installations and identify sites running WP Virtual Assistant version 3.0 or earlier
Review web server logs for anomalous request patterns targeting plugin AJAX or REST endpoints
Correlate unauthenticated request activity with subsequent changes in WordPress content or plugin data

Monitoring Recommendations

Enable verbose logging on WordPress and the reverse proxy to capture all plugin endpoint invocations
Alert on high-volume or scripted access to admin-ajax.php from single source IP addresses
Monitor plugin file integrity and database tables owned by WP Virtual Assistant for unauthorized changes

How to Mitigate CVE-2025-60155

Immediate Actions Required

Deactivate the WP Virtual Assistant plugin until a vendor-supplied patch is available for versions above 3.0
Restrict access to admin-ajax.php and REST API routes at the web application firewall (WAF) layer where feasible
Audit user accounts and content for unauthorized changes made through the plugin

Patch Information

At the time of publication, no fixed version is listed. Vulnerable range covers all versions up to and including 3.0. Site administrators should monitor the Patchstack advisory and the WordPress plugin repository for a security update.

Workarounds

Uninstall the WP Virtual Assistant plugin if it is not business-critical
Deploy WAF rules blocking unauthenticated requests to the plugin's action handlers and REST routes
Enforce authentication in front of admin-ajax.php where the plugin's actions are exposed, using host-level access controls

bash

# Example WAF rule concept for restricting plugin endpoints
# Block unauthenticated POSTs to WP Virtual Assistant AJAX actions
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,deny,status:403,id:1060155,msg:'Block WP Virtual Assistant unauth access'"
SecRule ARGS:action "@rx ^(virtualassistant|wp_virtual_assistant)_" \
  "chain"
SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"