PT-2025-38102 · WordPress · Uss Upyun

Claw.K + 1 · Published 2025-09-17 · Updated 2025-09-17 · CVE-2025-9629

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions USS Upyun plugin for WordPress versions prior to 1.5.1

Description The USS Upyun plugin for WordPress is susceptible to a Cross-Site Request Forgery issue. This is due to missing or incorrect nonce validation within the uss setting page function when handling the uss set form type. Successful exploitation allows unauthenticated attackers to modify critical Upyun cloud storage settings, including the bucket name, operator credentials, upload paths, and image processing parameters, by forging requests and tricking a site administrator into performing an action.

Recommendations Update the USS Upyun plugin to version 1.5.1 or later.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-9629

Affected Products

Uss Upyun

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-9629 · Security Note
• https://plugins.trac.wordpress.org/browser/uss-upyun/tags/1.5.1/upyun-uss-wordpress.php#L493 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/d2cee46a-03d5-4a31-ba15-28be97794199?source=cve · Note
• https://t.me/cveNotify/135615 · Telegram Post
• https://twitter.com/CVEnew/status/1968190749373088107 · Twitter Post
• https://plugins.trac.wordpress.org/browser/uss-upyun/tags/1.5.0/upyun-uss-wordpress.php#L499 · Note
• https://plugins.trac.wordpress.org/browser/uss-upyun/tags/1.5.0/upyun-uss-wordpress.php#L493 · Note
• https://twitter.com/VulmonFeeds/status/1968170512812523600 · Twitter Post
• https://t.me/CVEtracker/32708 · Telegram Post