PT-2025-44916 · WordPress · Ce21 Suite

Kenneth Dunn · Published 2025-11-04 · Updated 2025-11-04 · CVE-2025-11007

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CE21 Suite versions 2.2.1 through 2.3.1

Description The CE21 Suite plugin for WordPress is affected by an issue allowing unauthorized updates to plugin settings. A missing capability check on the wp ajax nopriv ce21 single sign on save api settings AJAX action allows unauthenticated attackers to modify the plugin’s API settings, including a secret key used for authentication. Successful exploitation enables attackers to create new administrator accounts on a vulnerable site.

Recommendations Update CE21 Suite to a version later than 2.3.1.

Fix

LPE

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2025-11007

Affected Products

Ce21 Suite

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-11007 · Security Note
• https://wordpress.org/plugins/ce21-suite · Note
• https://t.me/CVEtracker/36476 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/5e24feac-1812-45d7-b3c3-27787eed1cf1?source=cve · Note
• https://t.me/cveNotify/141480 · Telegram Post