What the vulnerability does
01Description
Missing Authorization vulnerability in javothemes Javo Core javo-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Javo Core: from n/a through <= 3.0.0.529.
CVE-2025-58877
HIGH
CVE-2025-58877: WordPress Javo Core plugin <= 3.0.0.529 - Arbitrary Content Deletion vulnerability
CVSS base score
7.5/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Explanation of Vulnerability in Simple Terms
02Summary
Javo Core versions up to 3.0.0.529 lack proper authorization checks, allowing unauthenticated attackers to disrupt site availability. The vulnerability requires no user interaction and can be exploited remotely over the network. Site administrators should update to a version newer than 3.0.0.529 to restore protection.
What an attacker can do
03Attacker Capabilities
Make the site unavailable or unresponsive to legitimate users.
Potential impact on your site
04Site Impact
Your site may become unavailable or slow without warning, affecting visitor access and revenue.
Conditions required to exploit
05Prerequisites
Network access only; no authentication or user interaction required.
Key dates
06Disclosure timeline
December 18, 2025
CVE published
April 28, 2026
Record updated
External resources
07References
Related vulnerabilities
08Related CVE
CVE-2026-57339 WordPress Business Directory plugin <= 6.4.23 - Broken Access Control vulnerability
CVE-2026-12122 Kirki <= 6.0.11 - Missing Authorization to Unauthenticated Sensitive Information Exposure via kirki_post_apis_nopriv AJAX Action
CVE-2025-69134 WordPress OpenAI Chatbot for WordPress – Helper plugin <= 1.1.4 - Arbitrary Content Deletion vulnerability
CVE-2026-12472 Kirki <= 6.0.11 - Missing Authorization to Unauthenticated Arbitrary Email Content Injection (Mail Relay / Phishing) via 'emailBody' and 'emailSubject' Parameters
CVE-2026-57746 WordPress Booked plugin <= 3.0.0 - Broken Access Control vulnerability
