Platform
wordpress
Component
wpcasa
Fixed in
1.4.2
CVE-2025-9321 describes a critical code injection vulnerability affecting the WPCasa plugin for WordPress. This flaw allows unauthenticated attackers to execute arbitrary code on vulnerable systems. The vulnerability impacts versions 0.0.0 through 1.4.1, and a patch is expected from the vendor. Immediate action is required to secure WordPress installations using this plugin.
The impact of this vulnerability is severe. An attacker can leverage this code injection flaw to gain complete control over a WordPress website. This includes the ability to modify website content, install malicious software, steal sensitive data (user credentials, customer information, database contents), and potentially pivot to other systems on the network. The lack of authentication required for exploitation significantly broadens the attack surface, making it accessible to a wide range of threat actors. Successful exploitation could lead to data breaches, website defacement, and significant reputational damage.
CVE-2025-9321 was publicly disclosed on 2025-09-23. The vulnerability's critical severity and ease of exploitation suggest a high probability of active exploitation. While no public proof-of-concept (PoC) code has been released at the time of writing, the potential for rapid development and dissemination of such code is high. Monitor security advisories and threat intelligence feeds for updates.
Exploit Status
EPSS
0.11% (30% percentile)
CISA SSVC
CVSS Vector
The primary mitigation is to immediately upgrade the WPCasa plugin to a patched version as soon as it becomes available. Until a patch is released, consider temporarily disabling the plugin to prevent exploitation. As a short-term workaround, implement strict input validation on all user-supplied data used by the 'apirequests' function. Web application firewalls (WAFs) configured to detect and block suspicious code injection attempts can provide an additional layer of defense. Monitor WordPress logs for unusual activity, particularly requests targeting the 'apirequests' endpoint.
Actualice el plugin WPCasa a la última versión disponible, ya que las versiones hasta 1.4.1 son vulnerables a la inyección de código. Verifique las actualizaciones disponibles en el panel de administración de WordPress o en el repositorio de plugins de WordPress. Implemente medidas de seguridad adicionales, como la limitación de acceso y la validación de entradas, para mitigar el riesgo.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2025-9321 is a critical vulnerability in the WPCasa WordPress plugin allowing unauthenticated attackers to execute code due to insufficient input validation. It affects versions 0.0.0–1.4.1.
If you are using WPCasa WordPress plugin versions 0.0.0 through 1.4.1, you are potentially affected. Check your plugin version immediately and upgrade if a patch is available.
The recommended fix is to upgrade to a patched version of the WPCasa plugin as soon as it's released. Until then, disable the plugin or implement strict input validation.
While no public exploit is currently available, the vulnerability's severity and ease of exploitation suggest a high probability of active exploitation. Monitor security advisories.
Refer to the WPCasa plugin's official website or WordPress plugin repository for the latest security advisory and patch information.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.