Missing Authorization in YayPricing by YayCommerce
CVE-2025-60077

7.5HIGH

Key Information:

Vendor

WordPress
Status
Yaypricing
Vendor
CVE Published:
18 December 2025

What is CVE-2025-60077?

A missing authorization vulnerability has been identified in YayPricing by YayCommerce. This flaw allows users to access functionalities that are not properly constrained by Access Control Lists (ACLs), potentially leading to unauthorized actions in the application. The vulnerability affects YayPricing plugin versions from an unspecified version up to and including 3.5.3, highlighting the need for users to upgrade to more secure versions. It is crucial for website operators to assess their setup and ensure that proper access controls are enforced to prevent exploitation.

Affected Version(s)

YayPricing 0 <= 3.5.3

References

https://patchstack.com/database/Wordpress/Plugin/yayprici...
vdb-entry

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Denver Jackson | Patchstack Bug Bounty Program
.