The vulnerability identified as CVE-2025-60077 affects YayCommerce's YayPricing plugin through version 3.5.3. It is a missing authorization issue where certain functionality is accessible without proper ACL enforcement, allowing unauthenticated remote attackers to access sensitive data or operations. The CVSS 3.1 base score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), reflecting network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, and high confidentiality impact. No patch or vendor advisory details are currently provided, and the product is not a cloud service.

Successful exploitation could lead to unauthorized access to sensitive information within the YayPricing plugin, compromising confidentiality. There is no impact on integrity or availability according to the CVSS vector. Since the vulnerability requires no privileges or user interaction, it poses a significant risk if exploited. However, no known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected YayPricing plugin functionality where possible and monitor for updates from YayCommerce. Avoid exposing the plugin to untrusted networks or users to reduce risk.