PT-2025-11236 · WordPress · Vidorev Extensions

Lucio Sá · Published 2025-03-14 · Updated 2025-03-14 · CVE-2025-0955

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions: VidoRev Extensions plugin for WordPress versions up to, and including, 2.9.9.9.9.9.5

Description: The issue is related to unauthorized access due to a missing capability check on the 'vidorev import single video' AJAX action. This allows unauthenticated attackers to import arbitrary YouTube videos.

Recommendations: For versions up to, and including, 2.9.9.9.9.5, consider disabling the 'vidorev import single video' AJAX action until a patch is available to prevent unauthorized access. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-0955

Affected Products

Vidorev Extensions

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-0955 · Security Note
• https://t.me/cvetracker/19095 · Telegram Post
• https://t.me/cvenotify/114806 · Telegram Post
• https://twitter.com/CVEnew/status/1900409139622207751 · Twitter Post
• https://themeforest.net/item/vidorev-video-wordpress-theme/21798615 · Note
• https://t.me/cvedetector/20272 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/e8c15662-e4df-4a74-bb01-266eeb4879c5?source=cve · Note