CVE-2025-60220 — AI Deep Analysis Summary

Q: Root Cause? (CWE/Flaw)

🛡️ **Root Cause**: **CWE-266** (Incorrect Privilege Assignment). 🔍 **Flaw**: The plugin fails to properly assign permissions. Users get access they shouldn't have. It’s a basic security logic error.

Q: Who is affected? (Versions/Components)

📦 **Affected**: WordPress Plugin **CouponXxL**. 📅 **Version**: **3.0.0** and earlier. 🏢 **Vendor**: **pebas**. If you use this coupon theme/plugin, you are at risk.

Q: What can hackers do? (Privileges/Data)

👑 **Hacker Power**: **Privilege Escalation**. 📂 **Data**: Full access to sensitive data. 🔓 **Control**: Can modify site content. Can execute actions as Admin. No limits on what they can break.

Q: Is there a public Exp? (PoC/Wild Exploitation)

🧪 **Public Exp?**: **No**. 📄 **PoC**: Empty list in data. 🌍 **Wild Exp**: Unconfirmed. However, the low barrier means PoCs will likely appear soon. Don't wait.

Q: How to self-check? (Features/Scanning)

🔎 **Self-Check**: Scan for **CouponXxL** plugin. 📊 **Version**: Check if version is **≤ 3.0.0**. 🛠️ **Tool**: Use WordPress vulnerability scanners. Look for 'pebas' vendor tags.

Q: What if no patch? (Workaround)

🚧 **No Patch?**: **Disable/Remove**. 🔒 **Mitigation**: Deactivate the CouponXxL plugin instantly. 🧹 **Clean**: Delete the plugin files if not needed. 🛡️ **WAF**: Block admin endpoints if possible.

Q: Is it urgent? (Priority Suggestion)

🔥 **Urgency**: **CRITICAL**. 🚨 **Priority**: **P1**. ⏱️ **Time**: Fix NOW. 📉 **Risk**: High CVSS + No Auth Required = Immediate Danger. Do not delay.

Updated May 06, 2026 CVSS 9.8 · Critical

This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis →

Q1What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: A critical privilege escalation flaw in CouponXxL. <br>💥 **Consequences**: Attackers can gain full control. CVSS score is **H** (High) across Confidentiality, Integrity, and Availability.…

Read full answer (login)

Q2Root Cause? (CWE/Flaw)

🛡️ **Root Cause**: **CWE-266** (Incorrect Privilege Assignment). <br>🔍 **Flaw**: The plugin fails to properly assign permissions. Users get access they shouldn't have. It’s a basic security logic error.

Q3Who is affected? (Versions/Components)

📦 **Affected**: WordPress Plugin **CouponXxL**. <br>📅 **Version**: **3.0.0** and earlier. <br>🏢 **Vendor**: **pebas**. If you use this coupon theme/plugin, you are at risk.

Q4What can hackers do? (Privileges/Data)

👑 **Hacker Power**: **Privilege Escalation**. <br>📂 **Data**: Full access to sensitive data. <br>🔓 **Control**: Can modify site content. Can execute actions as Admin. No limits on what they can break.

Q5Is exploitation threshold high? (Auth/Config)

⚡ **Threshold**: **LOW**. <br>🔑 **Auth**: **PR:N** (No Privileges Required). <br>🖱️ **UI**: **UI:N** (No User Interaction). <br>🌐 **Access**: **AV:N** (Network). Anyone on the internet can exploit this.…

Read full answer (login)

Q6Is there a public Exp? (PoC/Wild Exploitation)

🧪 **Public Exp?**: **No**. <br>📄 **PoC**: Empty list in data. <br>🌍 **Wild Exp**: Unconfirmed. However, the low barrier means PoCs will likely appear soon. Don't wait.

Q7How to self-check? (Features/Scanning)

🔎 **Self-Check**: Scan for **CouponXxL** plugin. <br>📊 **Version**: Check if version is **≤ 3.0.0**. <br>🛠️ **Tool**: Use WordPress vulnerability scanners. Look for 'pebas' vendor tags.

Q8Is it fixed officially? (Patch/Mitigation)

🩹 **Official Fix**: **Unknown**. <br>📝 **Status**: Data shows references to Patchstack, but no specific patch version listed. <br>⚠️ **Action**: Check vendor site immediately.…

Read full answer (login)

Q9What if no patch? (Workaround)

🚧 **No Patch?**: **Disable/Remove**. <br>🔒 **Mitigation**: Deactivate the CouponXxL plugin instantly. <br>🧹 **Clean**: Delete the plugin files if not needed. <br>🛡️ **WAF**: Block admin endpoints if possible.

Q10Is it urgent? (Priority Suggestion)

🔥 **Urgency**: **CRITICAL**. <br>🚨 **Priority**: **P1**. <br>⏱️ **Time**: Fix NOW. <br>📉 **Risk**: High CVSS + No Auth Required = Immediate Danger. Do not delay.

Continue exploring

Vulnerability detail Full AI analysis (login) pebas CWE-266