PT-2025-39118 · WordPress · Wpcasa

Michael Mazzolini · CVE-2025-9321 · Published 2025-09-23 · Updated 2025-09-28

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WPCasa plugin for WordPress versions prior to 1.4.2

Description The WPCasa plugin for WordPress is susceptible to Code Injection due to insufficient input validation and restriction on the api requests function. This allows unauthenticated attackers to call arbitrary functions and execute code.

Recommendations Update the WPCasa plugin to version 1.4.2 or later.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2025-9321

Affected Products

Wpcasa

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-9321 · Security Note
• https://twitter.com/CVEnew/status/1970393453231067540 · Twitter Post
• https://twitter.com/MNovofastovsky/status/1972268321207919081 · Twitter Post
• https://twitter.com/CveFindCom/status/1970347400435744840 · Twitter Post
• https://plugins.trac.wordpress.org/browser/wpcasa/trunk/includes/class-wpsight-api.php#L48 · Note
• https://twitter.com/NightfallCVE/status/1970860146890100831 · Twitter Post
• https://twitter.com/ZeroPathLabs/status/1970361586117214458 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/c1001b2b-395a-44ee-827e-6e57f7a50218?source=cve · Note
• https://plugins.trac.wordpress.org/changeset/3365172 · Note
• https://twitter.com/offseq/status/1970390494459916690 · Twitter Post