CVE-2025-60094

MediumCVSS 4.3

Published: 26/09/2025(UTC)Updated: 11/10/2026(UTC)Translated: 12/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

13th percentile - higher than 13% of all known CVEs

Summary

The Stackable (stackable-ultimate-gutenberg-blocks) plugin for WordPress in versions up to and including 3.18.1 contains a Missing Authorization vulnerability. It enables exploitation of incorrectly configured access control security levels.

Risk Assessment

An attacker may perform unauthorized operations on the site, potentially leading to modification of content or configuration.

Recommendation

Update the Stackable plugin to the latest version and review the permission configuration in your WordPress installation.

Other vulnerabilities in Stackable

CVE-2025-60095Medium
The Stackable plugin for WordPress has an insertion of sensitive information into sent data vulnerability that allows retrieval of embedded sensitive data. This issue affects versions from n/a through 3.18.1.

Original NVD description (English source)

Missing Authorization vulnerability in Benjamin Intal Stackable stackable-ultimate-gutenberg-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Stackable: from n/a through <= 3.18.1.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS