The vulnerability identified as CVE-2025-60120 affects WPDirectoryKit WP Directory Kit through version 1.4.0. It is characterized by missing authorization controls, which means that the software does not properly enforce access restrictions, potentially allowing unauthorized access to certain functions or data. The CVSS 3.1 base score is 5.3, reflecting a network attack vector with low complexity and no privileges or user interaction required. The impact is limited to partial confidentiality loss without integrity or availability impact. No vendor advisory or patch information is available at this time.

The vulnerability allows unauthorized access due to missing authorization checks, potentially exposing some confidential information. There is no impact on data integrity or system availability. No active exploitation has been reported, reducing immediate risk but the medium severity indicates that exploitation could lead to information disclosure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should review and tighten access control configurations where possible and monitor for updates from the WPDirectoryKit vendor or security advisories.