CVE-2025-60111 is a CSRF vulnerability in the javothemes Javo Core plugin (versions up to 3.0.0.266) that permits authentication bypass. The vulnerability allows attackers to exploit the lack of proper request validation to perform unauthorized actions on behalf of authenticated users. The CVSS 3.1 base score is 8.8, indicating high impact on confidentiality, integrity, and availability. No known exploits in the wild or vendor patches are currently documented.

Successful exploitation of this vulnerability can lead to an attacker bypassing authentication controls, potentially gaining unauthorized access and performing high-impact actions affecting confidentiality, integrity, and availability of the affected system. This could compromise sensitive data and system functionality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing CSRF protections such as verifying anti-CSRF tokens, restricting actions to trusted users, or applying compensating controls to limit exposure.