PT-2025-39118 · WordPress · Wpcasa

Michael Mazzolini · CVE-2025-9321 · Publicado 2025-09-23 · Atualizado 2025-09-28

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WPCasa plugin for WordPress versions prior to 1.4.2

Description The WPCasa plugin for WordPress is susceptible to Code Injection due to insufficient input validation and restriction on the api requests function. This allows unauthenticated attackers to call arbitrary functions and execute code.

Recommendations Update the WPCasa plugin to version 1.4.2 or later.

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2025-9321

Produtos afetados

Wpcasa

Referências · 10

• https://twitter.com/CVEnew/status/1970393453231067540 · Publicação no Twitter
• https://twitter.com/MNovofastovsky/status/1972268321207919081 · Publicação no Twitter
• https://twitter.com/CveFindCom/status/1970347400435744840 · Publicação no Twitter
• https://plugins.trac.wordpress.org/browser/wpcasa/trunk/includes/class-wpsight-api.php#L48 · Nota
• https://twitter.com/NightfallCVE/status/1970860146890100831 · Publicação no Twitter
• https://twitter.com/ZeroPathLabs/status/1970361586117214458 · Publicação no Twitter
• https://wordfence.com/threat-intel/vulnerabilities/id/c1001b2b-395a-44ee-827e-6e57f7a50218?source=cve · Nota
• https://plugins.trac.wordpress.org/changeset/3365172 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-9321 · Nota de Segurança
• https://twitter.com/offseq/status/1970390494459916690 · Publicação no Twitter