Compliance Impact

The vulnerability in PT Luxa Addons Plugin allows attackers to upload arbitrary malicious files, potentially leading to unauthorized access and control over the affected website.

Such unauthorized access and potential data breaches can compromise the confidentiality, integrity, and availability of sensitive data, which are critical requirements under common standards and regulations like GDPR and HIPAA.

Therefore, if exploited, this vulnerability could lead to non-compliance with these regulations due to failure to protect personal or sensitive data adequately.

Useful 0 Not Useful 0

Executive Summary

CVE-2025-60218 is a critical vulnerability in the WordPress PT Luxa Addons Plugin versions 1.2.2 and below that allows arbitrary file uploads.

This flaw enables attackers with only Subscriber-level privileges to upload malicious files, such as backdoors, to the affected website.

Exploiting this vulnerability can lead to unauthorized access and control over the website.

The vulnerability is highly dangerous with a CVSS score of 9.9 and falls under the OWASP Top 10 category A3: Injection.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts including unauthorized access to your website by attackers.

Attackers can upload malicious files such as backdoors, which can be used to maintain persistent access, manipulate website content, steal data, or launch further attacks.

Given the high CVSS score of 9.9, it is likely to be targeted in mass-exploit campaigns, increasing the risk of compromise.

Immediate action such as updating the plugin or applying mitigation rules is recommended to prevent exploitation.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability in PT Luxa Addons Plugin versions 1.2.2 and below allows arbitrary file uploads by users with Subscriber-level privileges, which can lead to unauthorized access.

Immediate mitigation steps include updating the plugin to a newer version if available.

If no official patch is available yet, applying the temporary mitigation rule provided by Patchstack is recommended to block attacks until a permanent fix is released.

Useful 0 Not Useful 0