CVE-2025-1322

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-1322", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-02-14T23:28:25.553Z", "datePublished": "2025-03-08T09:22:54.989Z", "dateUpdated": "2026-04-08T17:21:10.668Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:21:10.668Z"}, "affected": [{"vendor": "wppost", "product": "WP-Recall \u2013 Registration, Profile, Commerce & More", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "16.26.10", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The WP-Recall \u2013 Registration, Profile, Commerce & More plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 16.26.10 via the 'feed' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to view data from password protected, private, or draft posts that they should not have access to."}], "title": "WP-Recall \u2013 Registration, Profile, Commerce & More <= 16.26.10 - Authenticated (Contributor+) Protected Post Disclosure", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c667be65-e6d3-40e1-aeec-384d309fde3d?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3250094/wp-recall/trunk/add-on/rcl-chat/core.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor", "cweId": "CWE-200", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Krzysztof Zaj\u0105c"}], "timeline": [{"time": "2025-03-07T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-03-10T16:56:55.569068Z", "id": "CVE-2025-1322", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-11T16:07:44.076Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-1322", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-03-10T16:56:55.569068Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-10T16:56:56.801Z"}}], "cna": {"title": "WP-Recall \u2013 Registration, Profile, Commerce & More <= 16.26.10 - Authenticated (Contributor+) Protected Post Disclosure", "credits": [{"lang": "en", "type": "finder", "value": "Krzysztof Zaj\u0105c"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"}}], "affected": [{"vendor": "wppost", "product": "WP-Recall \u2013 Registration, Profile, Commerce & More", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "16.26.10"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-03-07T00:00:00.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c667be65-e6d3-40e1-aeec-384d309fde3d?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3250094/wp-recall/trunk/add-on/rcl-chat/core.php"}], "descriptions": [{"lang": "en", "value": "The WP-Recall \u2013 Registration, Profile, Commerce & More plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 16.26.10 via the 'feed' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to view data from password protected, private, or draft posts that they should not have access to."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-03-08T09:22:54.989Z"}}}, "cveMetadata": {"cveId": "CVE-2025-1322", "state": "PUBLISHED", "dateUpdated": "2025-03-11T16:07:44.076Z", "dateReserved": "2025-02-14T23:28:25.553Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-03-08T09:22:54.989Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "WP-Recall \u2013 Registration, Profile, Commerce & More", "vendor": "wppost", "versions": [{"lessThanOrEqual": "16.26.10", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:plechevandrey:wp-recall:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "E39CB4E3-D118-4652-8317-06A6DD1FD41D", "versionEndExcluding": "16.26.12", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The WP-Recall \u2013 Registration, Profile, Commerce & More plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 16.26.10 via the 'feed' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to view data from password protected, private, or draft posts that they should not have access to."}, {"lang": "es", "value": "El complemento WP-Recall \u2013 Registration, Profile, Commerce &amp; More para WordPress es vulnerable a la exposici\u00f3n de informaci\u00f3n en todas las versiones hasta la 16.26.10 incluida a trav\u00e9s del c\u00f3digo abreviado \"feed\" debido a restricciones insuficientes sobre qu\u00e9 publicaciones se pueden incluir. Esto permite que atacantes no autenticados vean datos de publicaciones protegidas con contrase\u00f1a, privadas o en borrador a las que no deber\u00edan tener acceso."}], "id": "CVE-2025-1322", "lastModified": "2026-06-17T08:38:55.060", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-1322", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-03-10T16:56:55.569068Z", "version": "2.0.3"}}]}, "published": "2025-03-08T10:15:10.583", "references": [{"source": "security@wordfence.com", "tags": ["Patch"], "url": "https://plugins.trac.wordpress.org/changeset/3250094/wp-recall/trunk/add-on/rcl-chat/core.php"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c667be65-e6d3-40e1-aeec-384d309fde3d?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "security@wordfence.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T22:02:49.478850+00:00", "value": {"mitigation_remediation": ["Update the WP\u2011Recall plugin to a version newer than 16.26.10 that resolves the shortcode restriction issue.", "Restrict the use of the 'feed' shortcode or the plugin\u2019s feed feature to authenticated users only, or remove it altogether if it is not required.", "Review post visibility settings and ensure that password\u2011protected, private, or draft posts are excluded from any procedures or feeds that expose content to unauthenticated contexts."], "summary": {"action": "Patch Update", "impact": "Information Exposure"}, "threat_synthesis": {"affected_systems": "The affected vendor is WP\u2011Recall, a WordPress plugin that provides registration, profile, commerce, and related functionality. All versions up to and including 16.26.10 are vulnerable. The flaw resides in the plugin's processing of the 'feed' shortcode, which does not properly restrict which posts may be included.", "description_and_impact": "The WP\u2011Recall \u2013 Registration, Profile, Commerce & More plugin for WordPress contains an information exposure flaw that allows unauthenticated attackers to retrieve content from password protected, private, or draft posts via the 'feed' shortcode. The vulnerability arises because the plugin does not properly restrict which posts may be included, violating the intended access controls. As a result, attackers can read confidential post data, compromising user privacy and content confidentiality.", "risk_and_exploitability": "The CVSS score of 4.3 indicates a moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation at the current time. The vulnerability does not appear in the CISA KEV catalog, and there are no indications that a public exploit is actively circulating. The likely attack vector involves placing or requesting the 'feed' shortcode from a public page, thereby triggering the plugin to expose restricted post content. While the exploitation requires no special privileges, the impact is limited to inadvertent leakage of post data."}}}}, "created": "2026-04-21T22:15:45.896167+00:00", "updated": "2026-04-21T22:15:45.896183+00:00", "vendors": []}