What is the CVSS score of CVE-2025-60222?

CVE-2025-60222 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2025-60222?

FantasticPlugins SUMO Memberships for WooCommerce versions 7.8.0 and earlier contain a privilege escalation vulnerability that allows any authenticated user to gain administrative-level access to…

How to fix or mitigate CVE-2025-60222?

Within 24 hours: Identify all WordPress instances running SUMO Memberships ≤7.8.0 using plugin inventory tools; document affected sites and user counts. Within 7 days: Deactivate and remove the plugin from all production environments, or if operationally critical, restrict plugin access via role-based controls and Web Application Firewall rules to trusted IPs only. Within 30 days: Monitor Patchstack and FantasticPlugins channels for vendor patch release (target version >7.8.0); conduct access audit for any unauthorized privilege changes during exposure period.

PHP CVE-2025-60222

HIGH

Incorrect Privilege Assignment (CWE-266)

2025-10-22 audit@patchstack.com

WordPress PHP Privilege Escalation

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 01, 2026 - 15:22 vuln.today

CVE Published

Oct 22, 2025 - 15:15 nvd

HIGH 8.8

DescriptionCVE.org

Incorrect Privilege Assignment vulnerability in FantasticPlugins SUMO Memberships for WooCommerce sumomemberships allows Privilege Escalation.This issue affects SUMO Memberships for WooCommerce: from n/a through <= 7.8.0.

AnalysisAI

Privilege escalation in FantasticPlugins SUMO Memberships for WooCommerce (versions ≤7.8.0) allows authenticated users with low-level privileges to elevate permissions and gain unauthorized high-level access to WordPress site functions. The vulnerability stems from incorrect privilege assignment (CWE-266), enabling attackers to bypass intended access controls. With CVSS 8.8 (High) severity, the flaw permits complete compromise of confidentiality, integrity, and availability. EPSS probability is low (0.06%, 17th percentile), and no public exploit identified at time of analysis, though Patchstack has published advisory details.

Technical ContextAI

This vulnerability affects the SUMO Memberships for WooCommerce plugin, a membership management system for WordPress e-commerce sites. CWE-266 (Incorrect Privilege Assignment) indicates the plugin fails to properly validate or enforce user role boundaries when performing privileged operations. In WordPress plugins, this typically occurs when sensitive administrative functions lack proper capability checks (e.g., missing current_user_can() guards) or when role verification logic contains flaws allowing lower-privileged users (Subscriber, Customer, Contributor) to invoke functions intended only for Administrators or Shop Managers. The WooCommerce integration context suggests membership role manipulation or payment-gated content access controls may be bypassable. All versions through 7.8.0 contain the flawed privilege assignment logic.

Affected ProductsAI

FantasticPlugins SUMO Memberships for WooCommerce plugin for WordPress is affected in all versions from initial release through version 7.8.0 inclusive. This impacts WordPress sites running WooCommerce with the SUMO Memberships plugin installed for subscription and membership management. The vendor advisory and technical details are available through Patchstack's vulnerability database at the referenced URL, which indicates version 7.6.0 was specifically analyzed though the advisory confirms the flaw persists through 7.8.0.

RemediationAI

Upgrade the SUMO Memberships for WooCommerce plugin to version 7.8.1 or later if available, as the vulnerability affects all versions through 7.8.0. Site administrators should immediately audit existing user accounts for unauthorized privilege escalations by reviewing WordPress user roles in wp-admin Users section and checking WooCommerce customer roles for anomalies. Review site activity logs for suspicious administrative actions performed by non-admin accounts. Until patching is complete, consider temporarily restricting new user registrations or implementing additional authentication layers for customer accounts. Consult the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/sumomemberships/ for vendor-specific remediation guidance and detailed technical analysis. If patch version is not yet released, monitor FantasticPlugins official channels and WordPress plugin repository for security updates.