Is CVE-2025-60511 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-60511 being exploited in the wild.

How severe is CVE-2025-60511?

Medium severity, with a CVSS score of 4.3, published 21 October 2025.

Which products and versions are affected?

Moodle OpenAI Chat Block 3.0.1 (2025021700).

Is there a fix for CVE-2025-60511?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-60511 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-60511?

Check whether you run Moodle OpenAI Chat Block at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-60511: Moodle OpenAI Chat Block IDOR in completion.php

CVE-2025-60511 · Severity: medium · CVSS 4.3 · Published 2025-10-21

The Moodle OpenAI Chat Block plugin, which allows users to interact with AI models within the Moodle learning platform, contains a security flaw. An authenticated user, such as a student, can manipulate requests to access chat configurations belonging to other users, including administrators. This could allow unauthorized users to view sensitive 'Source of Truth' data, access restricted AI models, or impersonate administrative AI personas, potentially leading to the exposure of private information or misuse of expensive API resources.

Vendors: Moodle.

Quick answers

Is CVE-2025-60511 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-60511 being exploited in the wild.
How severe is CVE-2025-60511?: Medium severity, with a CVSS score of 4.3, published 21 October 2025.
Which products and versions are affected?: Moodle OpenAI Chat Block 3.0.1 (2025021700).
Is there a fix for CVE-2025-60511?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-60511 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-60511?: Check whether you run Moodle OpenAI Chat Block at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An Insecure Direct Object Reference (IDOR) vulnerability exists in the Moodle OpenAI Chat Block plugin v3.0.1 (Build: 2025021700) within the /blocks/openai_chat/api/completion.php endpoint. The application fails to perform sufficient access control validation on the 'blockId' parameter provided in POST requests. An authenticated attacker (e.g., a student) can supply a 'blockId' belonging to another user, such as an administrator, to execute OpenAI completions using that user's specific configuration. This includes access to restricted prompt templates, 'Source of Truth' entries, and potentially higher-cost models (like GPT-4) configured for administrative use. The vulnerability allows for unauthorized information disclosure and resource consumption.

Affected products

Moodle OpenAI Chat Block plugin (block_openai_chat) 3.0.1 (2025021700)

Timeline

2025-10-21: advisory: NVD published date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.