PT-2025-38102 · WordPress · Uss Upyun

Claw.K + 1 · Publicado 2025-09-17 · Atualizado 2025-09-17 · CVE-2025-9629

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions USS Upyun plugin for WordPress versions prior to 1.5.1

Description The USS Upyun plugin for WordPress is susceptible to a Cross-Site Request Forgery issue. This is due to missing or incorrect nonce validation within the uss setting page function when handling the uss set form type. Successful exploitation allows unauthenticated attackers to modify critical Upyun cloud storage settings, including the bucket name, operator credentials, upload paths, and image processing parameters, by forging requests and tricking a site administrator into performing an action.

Recommendations Update the USS Upyun plugin to version 1.5.1 or later.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2025-9629

Produtos afetados

Uss Upyun

Referências · 9

• https://plugins.trac.wordpress.org/browser/uss-upyun/tags/1.5.1/upyun-uss-wordpress.php#L493 · Nota
• https://wordfence.com/threat-intel/vulnerabilities/id/d2cee46a-03d5-4a31-ba15-28be97794199?source=cve · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-9629 · Nota de Segurança
• https://t.me/cveNotify/135615 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1968190749373088107 · Publicação no Twitter
• https://plugins.trac.wordpress.org/browser/uss-upyun/tags/1.5.0/upyun-uss-wordpress.php#L499 · Nota
• https://plugins.trac.wordpress.org/browser/uss-upyun/tags/1.5.0/upyun-uss-wordpress.php#L493 · Nota
• https://twitter.com/VulmonFeeds/status/1968170512812523600 · Publicação no Twitter
• https://t.me/CVEtracker/32708 · Publicação no Telegram