CVE-2025-60120: WordPress WP Directory Kit plugin <= 1.4.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in wpdirectorykit WP Directory Kit allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP Directory Kit: from n/a through 1.3.8.
Other sources
Missing Authorization vulnerability in WPDirectoryKit WP Directory Kit wpdirectorykit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Directory Kit: from n/a through <= 1.4.0.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-60120?
CVE-2025-60120 is considered a high severity vulnerability due to the potential for unauthorized access.
How do I fix CVE-2025-60120?
To fix CVE-2025-60120, ensure that your version of WP Directory Kit is upgraded to the latest version beyond 1.3.8.
What does CVE-2025-60120 affect?
CVE-2025-60120 affects WP Directory Kit versions from n/a through 1.3.8, allowing exploitations of incorrectly configured access control levels.
What type of vulnerability is CVE-2025-60120?
CVE-2025-60120 is classified as a Missing Authorization vulnerability.
Can I exploit CVE-2025-60120 remotely?
Yes, CVE-2025-60120 can potentially be exploited remotely if the access control is misconfigured.