PT-2025-39563 · Themegoods · Grand Conference Theme Custom Post Type

Bonds · Published 2025-09-26 · Updated 2026-01-27 · CVE-2025-60116

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ThemeGoods Grand Conference Theme Custom Post Type versions through 2.6.3

Description An authorization issue exists in the ThemeGoods Grand Conference Theme Custom Post Type. The problem stems from incorrectly configured access control security levels, potentially allowing unauthorized access.

Recommendations Update ThemeGoods Grand Conference Theme Custom Post Type to a version later than 2.6.3.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-60116

Affected Products

Grand Conference Theme Custom Post Type

References · 6

• https://osv.dev/vulnerability/CVE-2025-60116 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-60116 · Security Note
• https://t.me/cveNotify/150026 · Telegram Post
• https://twitter.com/CVEnew/status/1971499221686878641 · Twitter Post
• https://patchstack.com/database/wordpress/plugin/grandconference-custom-post/vulnerability/wordpress-grand-conference-theme-custom-post-type-plugin-2-6-3-broken-access-control-vulnerability?_s_id=cve · Note
• https://patchstack.com/database/Wordpress/Plugin/grandconference-custom-post/vulnerability/wordpress-grand-conference-theme-custom-post-type-plugin-2-6-3-broken-access-control-vulnerability?_s_id=cve · Note