CVE-2025-5835

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-5835", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-06-06T19:42:06.965Z", "datePublished": "2025-07-25T06:43:55.268Z", "dateUpdated": "2026-04-08T17:29:18.756Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:29:18.756Z"}, "affected": [{"vendor": "Droip", "product": "Droip", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.2.6", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Droip plugin for WordPress is vulnerable to unauthorized modification and access of data due to a missing capability check on the droip_post_apis() function in all versions up to, and including, 2.2.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform many actions as the AJAX hooks to several functions. Some potential impacts include arbitrary post deletion, arbitrary post creation, post duplication, settings update, user manipulation, and much more."}], "title": "Droip <= 2.2.6 - Missing Authorization to Authenticated (Subscriber+) Many Actions", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e2e6b451-9835-4887-ade7-b18807223a88?source=cve"}, {"url": "https://droip.com/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Friderika Baranyai"}], "timeline": [{"time": "2025-07-24T17:25:41.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-07-25T11:42:11.603733Z", "id": "CVE-2025-5835", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-25T11:42:18.743Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-5835", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-07-25T11:42:11.603733Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-25T11:42:13.987Z"}}], "cna": {"title": "Droip <= 2.2.6 - Missing Authorization to Authenticated (Subscriber+) Many Actions", "credits": [{"lang": "en", "type": "finder", "value": "Friderika Baranyai"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "Droip", "product": "Droip", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.2.6"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-07-24T17:25:41.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e2e6b451-9835-4887-ade7-b18807223a88?source=cve"}, {"url": "https://droip.com/"}], "descriptions": [{"lang": "en", "value": "The Droip plugin for WordPress is vulnerable to unauthorized modification and access of data due to a missing capability check on the droip_post_apis() function in all versions up to, and including, 2.2.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform many actions as the AJAX hooks to several functions. Some potential impacts include arbitrary post deletion, arbitrary post creation, post duplication, settings update, user manipulation, and much more."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:29:18.756Z"}}}, "cveMetadata": {"cveId": "CVE-2025-5835", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:29:18.756Z", "dateReserved": "2025-06-06T19:42:06.965Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-07-25T06:43:55.268Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Droip", "vendor": "Droip", "versions": [{"lessThanOrEqual": "2.2.6", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:themeum:droip:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "309A8C64-FCCF-4FBC-936E-766DEBDA6B88", "versionEndIncluding": "2.2.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Droip plugin for WordPress is vulnerable to unauthorized modification and access of data due to a missing capability check on the droip_post_apis() function in all versions up to, and including, 2.2.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform many actions as the AJAX hooks to several functions. Some potential impacts include arbitrary post deletion, arbitrary post creation, post duplication, settings update, user manipulation, and much more."}, {"lang": "es", "value": "El complemento Droip para WordPress es vulnerable a modificaciones y accesos no autorizados a los datos debido a la falta de una comprobaci\u00f3n de capacidad en la funci\u00f3n droip_post_apis() en todas las versiones hasta la 2.2.0 incluida. Esto permite a atacantes autenticados, con acceso de suscriptor o superior, realizar numerosas acciones, ya que AJAX se conecta a varias funciones. Algunos posibles impactos incluyen la eliminaci\u00f3n, creaci\u00f3n y duplicaci\u00f3n de publicaciones arbitrarias, la actualizaci\u00f3n de la configuraci\u00f3n, la manipulaci\u00f3n del usuario y mucho m\u00e1s."}], "id": "CVE-2025-5835", "lastModified": "2026-06-17T09:48:50.463", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-5835", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-07-25T11:42:11.603733Z", "version": "2.0.3"}}]}, "published": "2025-07-25T07:15:27.653", "references": [{"source": "security@wordfence.com", "tags": ["Product"], "url": "https://droip.com/"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e2e6b451-9835-4887-ade7-b18807223a88?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-20T22:06:38.450352+00:00", "value": {"mitigation_remediation": ["Upgrade the Droip plugin to the latest version available to restore proper capability checks for all AJAX actions.", "Remove or limit the Subscriber role\u2019s access to the exposed AJAX endpoints by adjusting role capabilities or using a role\u2011management plugin.", "Deactivate or uninstall the Droip plugin until an updated version with proper capability checks is released."], "summary": {"action": "Patch Immediately", "impact": "Privilege Escalation"}, "threat_synthesis": {"affected_systems": "All WordPress sites that have the Droip plugin version 2.2.6 or older are affected. The vulnerability is present in every release upstream from the initial version up to and including 2.2.6 distributed by Themeum. Sites that do not run the plugin, or run a newer version, are not impacted.", "description_and_impact": "The Droip plugin for WordPress contains a missing capability check in its droip_post_apis() function that is used by several AJAX hooks. Because the function does not verify the current user\u2019s permissions, authenticated users who hold the Subscriber role or higher can invoke these hooks to perform any action that the plugin exposes. The exposed actions include arbitrary post deletion, creation and duplication, updating plugin settings, and manipulating users. The flaw effectively allows a legitimate user with a low\u2011level role to perform high\u2011privilege operations and compromises site integrity. This weakness is classified as CWE\u2011862, missing authorization.", "risk_and_exploitability": "The flaw has a CVSS score of 8.8, reflecting a high impact and critical scope. However, the EPSS score is less than 1% and the vulnerability is not listed in CISA\u2019s KEV catalog, indicating a low probability of exploitation at present. To exploit the issue an attacker must first be able to authenticate to the site with a Subscriber role or higher and then invoke any of the exposed AJAX endpoints. Once authenticated, the attacker can carry out the aforementioned high\u2011privilege actions until the plugin is updated or mitigated."}}}}, "created": "2025-07-25T15:53:53.677456+00:00", "updated": "2026-04-20T22:15:06.190976+00:00", "vendors": ["themeum", "themeum$PRODUCT$droip", "wordpress", "wordpress$PRODUCT$wordpress"]}