CVE-2025-60152

Vulnerability

Overview The Subscribe To Unlock plugin for WordPress, versions up to and including 1.1.5, contains a missing authorization vulnerability. This flaw stems from incorrectly configured access control security levels, allowing unauthenticated attackers to bypass intended restrictions [1].

Exploitation

Details The vulnerability is classified as a broken access control issue, meaning the plugin fails to properly verify user permissions or nonce tokens in certain functions. Attackers can exploit this without authentication, targeting any site running the vulnerable plugin version [1].

Impact

Successful exploitation enables an attacker to perform actions that should require higher privileges, potentially leading to unauthorized content access or other restricted operations. This vulnerability is actively used in mass-exploit campaigns against thousands of websites [1].

Mitigation

The vendor has not released a patched version; users should immediately update the plugin if a fix becomes available. As a workaround, site administrators can consult their hosting provider or web developer to implement additional access controls or disable the plugin until a patch is applied [1].