CVE-2025-4855

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-4855", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-05-16T17:00:48.567Z", "datePublished": "2025-07-08T23:22:49.550Z", "dateUpdated": "2026-04-08T17:15:40.803Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:15:40.803Z"}, "affected": [{"vendor": "Schiocco", "product": "Support Board", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.8.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Support Board plugin for WordPress is vulnerable to unauthorized access/modification/deletion of data due to use of hardcoded default secrets in the sb_encryption() function in all versions up to, and including, 3.8.0. This makes it possible for unauthenticated attackers to bypass authorization and execute arbitrary AJAX actions defined in the sb_ajax_execute() function. An attacker can use this vulnerability to exploit CVE-2025-4828 and various other functions unauthenticated."}], "title": "Support Board <= 3.8.0 - Unauthenticated Authorization Bypass due to Use of Default Secret Key", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/afd48bc8-d490-4a3e-97fc-70cf008cbf66?source=cve"}, {"url": "https://codecanyon.net/item/support-board-help-desk-and-chat/20359943"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-639 Authorization Bypass Through User-Controlled Key", "cweId": "CWE-639", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}}], "credits": [{"lang": "en", "type": "finder", "value": "Friderika Baranyai"}], "timeline": [{"time": "2025-05-15T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2025-07-07T16:15:34.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-07-08T10:43:20.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-07-09T13:14:52.717607Z", "id": "CVE-2025-4855", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-09T13:14:58.196Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-4855", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-07-09T13:14:52.717607Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-09T13:14:55.489Z"}}], "cna": {"title": "Support Board <= 3.8.0 - Unauthenticated Authorization Bypass due to Use of Default Secret Key", "credits": [{"lang": "en", "type": "finder", "value": "Friderika Baranyai"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "Schiocco", "product": "Support Board", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.8.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-05-15T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2025-07-07T16:15:34.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-07-08T10:43:20.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/afd48bc8-d490-4a3e-97fc-70cf008cbf66?source=cve"}, {"url": "https://codecanyon.net/item/support-board-help-desk-and-chat/20359943"}], "descriptions": [{"lang": "en", "value": "The Support Board plugin for WordPress is vulnerable to unauthorized access/modification/deletion of data due to use of hardcoded default secrets in the sb_encryption() function in all versions up to, and including, 3.8.0. This makes it possible for unauthenticated attackers to bypass authorization and execute arbitrary AJAX actions defined in the sb_ajax_execute() function. An attacker can use this vulnerability to exploit CVE-2025-4828 and various other functions unauthenticated."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639 Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:15:40.803Z"}}}, "cveMetadata": {"cveId": "CVE-2025-4855", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:15:40.803Z", "dateReserved": "2025-05-16T17:00:48.567Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-07-08T23:22:49.550Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Support Board", "vendor": "Schiocco", "versions": [{"lessThanOrEqual": "3.8.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:schiocco:support_board:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "382A28AC-EA54-47C5-8B04-8F591BDC4171", "versionEndExcluding": "3.8.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Support Board plugin for WordPress is vulnerable to unauthorized access/modification/deletion of data due to use of hardcoded default secrets in the sb_encryption() function in all versions up to, and including, 3.8.0. This makes it possible for unauthenticated attackers to bypass authorization and execute arbitrary AJAX actions defined in the sb_ajax_execute() function. An attacker can use this vulnerability to exploit CVE-2025-4828 and various other functions unauthenticated."}, {"lang": "es", "value": "El complemento Support Board para WordPress es vulnerable al acceso, modificaci\u00f3n y eliminaci\u00f3n no autorizados de datos debido al uso de secretos predeterminados codificados en la funci\u00f3n sb_encryption() en todas las versiones hasta la 3.8.0 incluida. Esto permite a atacantes no autenticados eludir la autorizaci\u00f3n y ejecutar acciones AJAX arbitrarias definidas en la funci\u00f3n sb_ajax_execute(). Un atacante puede usar esta vulnerabilidad para explotar CVE-2025-4828 y otras funciones sin autenticar."}], "id": "CVE-2025-4855", "lastModified": "2026-06-17T09:34:09.807", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-4855", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-07-09T13:14:52.717607Z", "version": "2.0.3"}}]}, "published": "2025-07-09T00:15:47.243", "references": [{"source": "security@wordfence.com", "tags": ["Product"], "url": "https://codecanyon.net/item/support-board-help-desk-and-chat/20359943"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/afd48bc8-d490-4a3e-97fc-70cf008cbf66?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-20T22:21:27.704446+00:00", "value": {"mitigation_remediation": ["Upgrade the Support Board plugin to the latest release that removes the hardcoded default secret key.", "If an immediate upgrade is not possible, disable or uninstall the plugin to eliminate the exposed AJAX handlers.", "Deploy a web application firewall or modify the site\u2019s access controls to block unauthenticated access to the plugin\u2019s AJAX endpoints, and monitor logs for suspicious activity."], "summary": {"action": "Immediate Patch", "impact": "Unauthenticated Authorization Bypass and arbitrary data modification via hardcoded secret key"}, "threat_synthesis": {"affected_systems": "The affected product is the Support Board plugin developed by Schiocco, available for WordPress. All official releases numbered 3.8.0 and earlier are vulnerable. There is no other affected product listed.", "description_and_impact": "The support board plugin for WordPress contains a function that uses a hardcoded default secret key in all releases up to 3.8.0. This flaw allows an attacker with no authentication to bypass authorization checks and invoke any AJAX operation defined in sb_ajax_execute(). Because these operations can read, modify, or delete plugin data, an unauthenticated user can potentially takeover the plugin\u2019s data store and also trigger related vulnerabilities such as CVE-2025-4828.", "risk_and_exploitability": "The CVSS score of 9.8 reflects the high criticality of this flaw. The EPSS score of < 1% indicates that, although exploitation is unlikely to occur widely at present, the potential damage warrants immediate attention. The vulnerability is not currently listed in the CISA KEV catalog. Attackers can exploit it by sending unauthenticated HTTP requests to the plugin\u2019s AJAX endpoint, leveraging the hardcoded key to bypass authorization. No further prerequisites are stated, so the attack vector is inferred to be a simple web request to the improperly protected endpoint."}}}}, "created": "2025-07-13T21:08:10.306767+00:00", "updated": "2026-04-20T22:30:19.870810+00:00", "vendors": ["schiocco", "schiocco$PRODUCT$support_board", "wordpress", "wordpress$PRODUCT$wordpress"]}