Information Exposure Vulnerability in Crypto Plugin for WordPress

CVE-2025-11986

What is CVE-2025-11986?

The Crypto plugin for WordPress has a vulnerability that allows unauthenticated attackers to exploit an AJAX action called wp_ajax_nopriv_crypto_connect_ajax_process. This flaw exists in all versions up to and including 2.22, permitting attackers to invoke critical functions such as register and savenft without proper wallet signature verification. As a result, they can set a global authentication state across the entire site for all visitors, bypassing existing access controls. Additionally, this vulnerability can lead to complete evasion of restrictions imposed by the [crypto-block] shortcode, impacting all site visitors for a duration of one hour. Attackers may also inject arbitrary data into the custom_users table within the plugin, posing serious security risks.

References