Unauthorized Access Vulnerability in WP Online Contract Plugin by WordPress
CVE-2025-0954

6.5MEDIUM

Key Information:

Vendor
WordPress
Status
WP Online Contract
Vendor
CVE Published:
5 March 2025

Summary

The WP Online Contract plugin for WordPress exposes a critical vulnerability due to a lack of proper capability checks in its json_import() and json_export() functions. This oversight allows unauthorized users to import and export sensitive plugin settings, potentially leading to exploitation. All versions up to and including 5.1.4 are susceptible to this issue, emphasizing the need for immediate updates and security measures to safeguard user data.

Affected Version(s)

WP Online Contract * <= 5.1.4

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://codecanyon.net/item/wp-online-contract/7698011

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Lucio Sá
.