The vulnerability CVE-2025-60094 affects the Stackable plugin by Benjamin Intal, specifically versions up to and including 3.18.1. It is caused by missing authorization checks, which result in incorrectly configured access control security levels. This allows an attacker with low privileges to perform unauthorized actions that impact the integrity of the system. The CVSS 3.1 base score is 4.3 (medium), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality or availability impact, and limited integrity impact. No patch or vendor advisory is currently available to confirm remediation status.

The vulnerability allows attackers with low privileges to bypass authorization controls, leading to potential unauthorized modification of data or system behavior (integrity impact). There is no impact on confidentiality or availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to trusted users and monitor for suspicious activity related to Stackable plugin usage. Avoid granting unnecessary privileges to users to reduce risk.