We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Crisp.chat (Helpdesk and Chat)

Ok

THREATINT
PUBLISHED

CVE-2025-4654

Soumettre.fr <= 2.1.5 - Improper Authorization to Unauthenticated Soumettre Posts Creation/Modification/Deletion



Description

The Soumettre.fr plugin for WordPress is vulnerable to unauthorized access and modification of data due to a improper authorization checks on the make_signature function in all versions up to, and including, 2.1.5. This makes it possible for unauthenticated attackers to create/edit/delete Soumettre posts. This vulnerability affects only installations where the soumettre account is not connected (i.e. API key is not installed)

Reserved 2025-05-13 | Published 2025-07-02 | Updated 2025-07-02 | Assigner Wordfence


LOW: 3.7CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Problem types

CWE-285 Improper Authorization

Product status

Default status
unaffected

*
affected

Timeline

2025-05-09:Discovered
2025-07-01:Disclosed

Credits

Trương Hữu Phúc (truonghuuphuc) finder

References

www.wordfence.com/...-0730-437c-8065-309523278efa?source=cve

plugins.trac.wordpress.org/...class-soumettre-rest-route.php

cve.org (CVE-2025-4654)

nvd.nist.gov (CVE-2025-4654)

Download JSON

Share this page
https://cve.threatint.eu/CVE/CVE-2025-4654

Support options

Helpdesk Chat, Email, Knowledgebase