PT-2025-42308 · WordPress · Wordpress External Login

Published 2025-10-15 · Updated 2025-10-15 · CVE-2025-11196

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions WordPress External Login plugin versions through 1.11.2

Description The External Login plugin for WordPress has a flaw that could expose sensitive information. The 'exlog test connection' AJAX action does not properly verify user permissions or require security checks, allowing authenticated attackers with subscriber-level access or higher to access the configured external database. This access can reveal truncated usernames, email addresses, and password hashes through the diagnostic test results view.

Recommendations Update the WordPress External Login plugin to a version newer than 1.11.2.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2025-11196

Affected Products

Wordpress External Login

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-11196 · Security Note
• https://plugins.trac.wordpress.org/browser/external-login/trunk/options/testing_ajax.php#L3 · Note
• https://twitter.com/VulmonFeeds/status/1978422697966113055 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/bdb40f51-dac2-40e7-beb1-154d982f7af3?source=cve · Note
• https://t.me/CVEtracker/34985 · Telegram Post
• https://twitter.com/CVEnew/status/1978545110137934086 · Twitter Post
• https://plugins.trac.wordpress.org/browser/external-login/trunk/views/test_results.php#L21 · Note
• https://plugins.trac.wordpress.org/browser/external-login/trunk/login/db.php#L215 · Note