The vulnerability identified as CVE-2025-60114 affects the YayCurrency plugin by YayCommerce, allowing an attacker with high privileges to inject code due to improper control over code generation. The CVSS 3.1 score of 6.6 reflects a network attack vector with low attack complexity, requiring high privileges and no user interaction. The impact scope is changed, affecting confidentiality, integrity, and availability to a limited extent. The vulnerability affects all versions up to 3.3.1. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation could allow an attacker with high privileges to execute injected code, potentially leading to limited confidentiality loss, integrity compromise, and availability disruption. The impact is considered medium severity based on the CVSS score and vector, indicating that while the vulnerability is exploitable remotely, it requires elevated privileges and does not involve user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict high privilege access to the affected plugin and monitor for unusual activity related to code execution. Avoid deploying the affected versions in sensitive environments if possible.