CVE-2025-60122
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
The HivePress Claim Listings plugin for WordPress in versions up to and including 1.1.4 contains a Missing Authorization vulnerability. It allows exploitation of incorrectly configured access control security levels.
Risk Assessment
An unauthorized user may gain access to functions reserved for higher roles, potentially resulting in unauthorized changes on the site.
Recommendation
Update the HivePress Claim Listings plugin to the latest version and review role permissions in WordPress.
Other vulnerabilities in HivePress Claim Listings
See all- CVE-2026-42707Medium
The HivePress Claim Listings plugin through version 1.1.4 contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control levels. This may permit unauthorized operations.
- CVE-2025-60123Medium
The HivePress Claim Listings plugin for WordPress in versions up to and including 1.1.3 contains a Missing Authorization vulnerability. It enables exploitation of incorrectly configured access control security levels.
Original NVD description (English source)
Missing Authorization vulnerability in HivePress HivePress Claim Listings hivepress-claim-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HivePress Claim Listings: from n/a through <= 1.1.4.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS