PT-2025-27588 · WordPress · Soumettre.Fr

Trương Hữu Phúc + 1 · Published 2025-07-02 · Updated 2025-07-02 · CVE-2025-4654

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Soumettre.fr plugin for WordPress versions up to, and including, 2.1.5

Description: The issue is related to improper authorization checks on the make signature function, allowing unauthorized access and modification of data. This enables unauthenticated attackers to create, edit, or delete Soumettre posts. The vulnerability specifically affects installations where the Soumettre account is not connected, meaning the API key is not installed.

Recommendations: For versions up to, and including, 2.1.5, update to a version higher than 2.1.5 to resolve the issue. As a temporary workaround, consider disabling the make signature function until a patch is available. Restrict access to the Soumettre posts to minimize the risk of exploitation.

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2025-4654

Affected Products

Soumettre.Fr

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-4654 · Security Note
• https://t.me/cvenotify/127345 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/4f29d476-0730-437c-8065-309523278efa?source=cve · Note
• https://plugins.trac.wordpress.org/browser/soumettre-fr/tags/2.1.5/public/rest/class-soumettre-rest-route.php#L211 · Note