PT-2025-25367 · WordPress · Rest Api | Custom Api Generator For Cross Platform/Import Export In Wp
Kenneth Dunn
·
Published
2025-06-12
·
Updated
2025-06-18
·
CVE-2025-5288
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
REST API | Custom API Generator For Cross Platform And Import Export In WP plugin for WordPress versions 1.0.0 through 2.0.3
Description
The issue is related to a missing capability check on the
process handler() function, allowing unauthenticated attackers to escalate privileges. This can be achieved by sending a POST request with an arbitrary import api URL and specially crafted JSON data, resulting in the creation of a new user with full Administrator privileges.Recommendations
For versions 1.0.0 through 2.0.3, consider disabling the
process handler() function until a patch is available to prevent unauthenticated privilege escalation. Restrict access to the import API endpoint to minimize the risk of exploitation. Avoid using the import api URL in the affected API endpoint until the issue is resolved.Fix
LPE
Missing Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Rest Api | Custom Api Generator For Cross Platform/Import Export In Wp