CVE-2025-60220CWE-266

CVE-2025-60220

Critical · published October 22, 2025

CVSS v3.1
9.8
EPSS
0%
Percentile
38.3
In the wild
Unconfirmed
What it is

🚨 A privilege escalation vulnerability in CouponXxL means users can potentially gain unauthorized access to sensitive features! 🌪️ Think of it like a restaurant where the staff accidentally gives a diner the master key to the kitchen — they could whip up anything without permission! 🍽️ If an attacker exploits this vulnerability, they could gain access to admin-level controls, allowing them to modify settings, access sensitive data, or even disable security features. The potential fallout from this could be absolutely devastating for user trust and security. 🔥

Put simply

Think of it like a restaurant where the staff accidentally gives a diner the master key to the kitchen — they could whip up anything without permission! 🍽️ This incorrect privilege assignment flaw enables unauthorized access by allowing users to escalate their privileges beyond intended restrictions in CouponXxL version 3.0.0 and earlier.

What to do

If an attacker exploits this vulnerability, they could gain access to admin-level controls, allowing them to modify settings, access sensitive data, or even disable security features. The potential fallout from this could be absolutely devastating for user trust and security. 🔥 Immediately update CouponXxL to the latest version to patch this vulnerability. Review user role permissions and audit for any instances of privilege escalation. Ensure your security team is aware and prepared for possible unauthorized access attempts. 🛡️ You've got this! By taking these steps, you can lock down your application and keep those pesky attackers at bay! 💪✨

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00452 · 38.3th percentile
Weakness
CWE-266 · Incorrect Privilege Assignment
Published
2025-10-22T19:15Z
References (1)
EPSS history
Timeline
  • 22 OCT 14:32Z
    WordPress CouponXxL theme <= 3.0.0 - Privilege Escalation vulnerability
    cvelistv5