CVE-2025-11988

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-11988", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-20T19:32:02.759Z", "datePublished": "2025-11-11T03:30:35.177Z", "dateUpdated": "2026-04-08T16:45:20.211Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:45:20.211Z"}, "affected": [{"vendor": "odude", "product": "Crypto Tool", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.22", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Crypto plugin for WordPress is vulnerable to unauthorized manipulation of data in all versions up to, and including, 2.22. This is due to the plugin registering an unauthenticated AJAX action (wp_ajax_nopriv_crypto_connect_ajax_process) that allows calling the crypto_delete_json method with only a publicly-available nonce check. This makes it possible for unauthenticated attackers to delete specific JSON files matching the pattern *_pending.json within the wp-content/uploads/yak/ directory, causing data loss and denial of service for plugin workflows that rely on these artifacts."}], "title": "Crypto Tool <= 2.22 - Missing Authentication to Unauthenticated Limited File Deletion", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3281d6eb-9f14-43d4-a4d4-532993039e53?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/crypto/tags/2.22/includes/class-crypto_connect_ajax_register.php#L9"}, {"url": "https://plugins.trac.wordpress.org/browser/crypto/tags/2.22/includes/class-crypto_connect_ajax_register.php#L137"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Jonas Benjamin Friedli"}], "timeline": [{"time": "2025-11-10T15:07:28.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-12T17:02:01.078902Z", "id": "CVE-2025-11988", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-12T20:08:35.294Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-11988", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-12T17:02:01.078902Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-12T17:02:03.202Z"}}], "cna": {"title": "Crypto Tool <= 2.22 - Missing Authentication to Unauthenticated Limited File Deletion", "credits": [{"lang": "en", "type": "finder", "value": "Jonas Benjamin Friedli"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "odude", "product": "Crypto Tool", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.22"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-11-10T15:07:28.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3281d6eb-9f14-43d4-a4d4-532993039e53?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/crypto/tags/2.22/includes/class-crypto_connect_ajax_register.php#L9"}, {"url": "https://plugins.trac.wordpress.org/browser/crypto/tags/2.22/includes/class-crypto_connect_ajax_register.php#L137"}], "descriptions": [{"lang": "en", "value": "The Crypto plugin for WordPress is vulnerable to unauthorized manipulation of data in all versions up to, and including, 2.22. This is due to the plugin registering an unauthenticated AJAX action (wp_ajax_nopriv_crypto_connect_ajax_process) that allows calling the crypto_delete_json method with only a publicly-available nonce check. This makes it possible for unauthenticated attackers to delete specific JSON files matching the pattern *_pending.json within the wp-content/uploads/yak/ directory, causing data loss and denial of service for plugin workflows that rely on these artifacts."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:45:20.211Z"}}}, "cveMetadata": {"cveId": "CVE-2025-11988", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:45:20.211Z", "dateReserved": "2025-10-20T19:32:02.759Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-11T03:30:35.177Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Crypto Tool", "vendor": "odude", "versions": [{"lessThanOrEqual": "2.22", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Crypto plugin for WordPress is vulnerable to unauthorized manipulation of data in all versions up to, and including, 2.22. This is due to the plugin registering an unauthenticated AJAX action (wp_ajax_nopriv_crypto_connect_ajax_process) that allows calling the crypto_delete_json method with only a publicly-available nonce check. This makes it possible for unauthenticated attackers to delete specific JSON files matching the pattern *_pending.json within the wp-content/uploads/yak/ directory, causing data loss and denial of service for plugin workflows that rely on these artifacts."}, {"lang": "es", "value": "El plugin Crypto para WordPress es vulnerable a la manipulaci\u00f3n no autorizada de datos en todas las versiones hasta la 2.22, inclusive. Esto se debe a que el plugin registra una acci\u00f3n AJAX no autenticada (wp_ajax_nopriv_crypto_connect_ajax_process) que permite llamar al m\u00e9todo crypto_delete_json con solo una verificaci\u00f3n de nonce disponible p\u00fablicamente. Esto hace posible que atacantes no autenticados eliminen archivos JSON espec\u00edficos que coinciden con el patr\u00f3n *_pending.json dentro del directorio wp-content/uploads/yak/, causando p\u00e9rdida de datos y denegaci\u00f3n de servicio para los flujos de trabajo del plugin que dependen de estos artefactos."}], "id": "CVE-2025-11988", "lastModified": "2026-10-07T21:10:00.200", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-11988", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-12T17:02:01.078902Z", "version": "2.0.3"}}]}, "published": "2025-11-11T04:15:44.967", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/crypto/tags/2.22/includes/class-crypto_connect_ajax_register.php#L137"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/crypto/tags/2.22/includes/class-crypto_connect_ajax_register.php#L9"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3281d6eb-9f14-43d4-a4d4-532993039e53?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T12:28:35.950076+00:00", "value": {"mitigation_remediation": ["Upgrade the Crypto plugin to version 2.23 or newer, which removes the unauthenticated AJAX action", "If an upgrade is not immediately possible, disable the wp_ajax_nopriv_crypto_connect_ajax_process action by removing or unregistering it in the theme\u2019s functions.php or with a security plugin", "Restrict write permissions on the wp-content/uploads/yak/ directory so that only the web server owner retains deletion rights"], "summary": {"action": "Apply Patch", "impact": "Data Loss and Denial of Service via Unauthenticated File Deletion"}, "threat_synthesis": {"affected_systems": "WordPress installations that use the Crypto plugin from the odude vendor and are running any version up to and including 2.22 are affected. Sites that have not upgraded beyond this version and with the plugin enabled on a publicly accessible environment are vulnerable.", "description_and_impact": "The Crypto plugin for WordPress allows anyone to call the wp_ajax_nopriv_crypto_connect_ajax_process action without authenticating, relying only on a publicly available nonce. This enables an attacker to trigger the crypto_delete_json method and delete JSON files that match the pattern *_pending.json in the wp-content/uploads/yak/ directory. Removing those files destroys data that the plugin uses for its workflow, leading to loss of information and a potential denial of service for functions that depend on these artifacts.", "risk_and_exploitability": "The vulnerability carries a CVSS score of 5.3, indicating a moderate severity. Its EPSS score is less than 1\u202f%, suggesting a low probability of current exploitation, and it is not listed in the CISA KEV catalog. Attackers only need to send a crafted AJAX request from any IP address, or even from a browser in which no login is required, because the plugin does not verify the user's identity beyond the nonce. If the site is publicly reachable, the exploit is straightforward to execute."}}}}, "created": "2025-11-12T12:48:02.965327+00:00", "updated": "2026-04-22T12:30:16.836561+00:00", "vendors": ["odude", "odude$PRODUCT$crypto_tool", "wordpress", "wordpress$PRODUCT$wordpress"]}