PT-2025-30658 · WordPress · Ithoughts Advanced Code Editor

Nabil Irawan · CVE-2025-7835 · Published 2025-07-24 · Updated 2025-07-24

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions iThoughts Advanced Code Editor plugin for WordPress versions through 1.2.10

Description The iThoughts Advanced Code Editor plugin for WordPress is susceptible to Cross-Site Request Forgery due to missing or incorrect nonce validation on the ithoughts ace update options API endpoint. This allows unauthenticated attackers to update plugin settings via a forged request if they can trick a site administrator into performing an action.

Recommendations Update the iThoughts Advanced Code Editor plugin to a version later than 1.2.10.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-7835

Affected Products

Ithoughts Advanced Code Editor

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-7835 · Security Note
• https://wordpress.org/plugins/ithoughts-advanced-code-editor · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/e99ed03f-ed0a-4f17-b9fe-db0a0e573ed2?source=cve · Note
• https://twitter.com/VulmonFeeds/status/1948505975326953983 · Twitter Post
• https://twitter.com/CVEnew/status/1948319158535417878 · Twitter Post