平台
wordpress
组件
wpcasa
修复版本
1.4.2
CVE-2025-9321 describes a critical code injection vulnerability affecting the WPCasa plugin for WordPress. This flaw allows unauthenticated attackers to execute arbitrary code on vulnerable systems. The vulnerability impacts versions 0.0.0 through 1.4.1, and a patch is expected from the vendor. Immediate action is required to secure WordPress installations using this plugin.
The impact of this vulnerability is severe. An attacker can leverage this code injection flaw to gain complete control over a WordPress website. This includes the ability to modify website content, install malicious software, steal sensitive data (user credentials, customer information, database contents), and potentially pivot to other systems on the network. The lack of authentication required for exploitation significantly broadens the attack surface, making it accessible to a wide range of threat actors. Successful exploitation could lead to data breaches, website defacement, and significant reputational damage.
CVE-2025-9321 was publicly disclosed on 2025-09-23. The vulnerability's critical severity and ease of exploitation suggest a high probability of active exploitation. While no public proof-of-concept (PoC) code has been released at the time of writing, the potential for rapid development and dissemination of such code is high. Monitor security advisories and threat intelligence feeds for updates.
WordPress websites utilizing the WPCasa plugin, particularly those running older, unpatched versions (0.0.0–1.4.1), are at significant risk. Shared hosting environments where multiple websites share the same server infrastructure are especially vulnerable, as a compromise of one site could potentially lead to the compromise of others. Sites with weak security configurations or limited monitoring capabilities are also at higher risk.
• wordpress / composer / npm:
grep -r 'api_requests' /var/www/html/wp-content/plugins/wp-casas/• wordpress / composer / npm:
wp plugin list | grep wp-casas• wordpress / composer / npm:
curl -I http://your-wordpress-site.com/wp-content/plugins/wp-casas/readme.txt | grep Versiondisclosure
漏洞利用状态
EPSS
0.11% (30% 百分位)
CISA SSVC
CVSS 向量
The primary mitigation is to immediately upgrade the WPCasa plugin to a patched version as soon as it becomes available. Until a patch is released, consider temporarily disabling the plugin to prevent exploitation. As a short-term workaround, implement strict input validation on all user-supplied data used by the 'apirequests' function. Web application firewalls (WAFs) configured to detect and block suspicious code injection attempts can provide an additional layer of defense. Monitor WordPress logs for unusual activity, particularly requests targeting the 'apirequests' endpoint.
将 WPCasa 插件更新到最新可用版本，因为 1.4.1 及更早版本存在代码注入漏洞。在 WordPress 管理面板或 WordPress 插件仓库中检查是否有可用的更新。实施额外的安全措施，例如访问限制和输入验证，以降低风险。
漏洞分析和关键警报直接发送到您的邮箱。
CVE-2025-9321 is a critical vulnerability in the WPCasa WordPress plugin allowing unauthenticated attackers to execute code due to insufficient input validation. It affects versions 0.0.0–1.4.1.
If you are using WPCasa WordPress plugin versions 0.0.0 through 1.4.1, you are potentially affected. Check your plugin version immediately and upgrade if a patch is available.
The recommended fix is to upgrade to a patched version of the WPCasa plugin as soon as it's released. Until then, disable the plugin or implement strict input validation.
While no public exploit is currently available, the vulnerability's severity and ease of exploitation suggest a high probability of active exploitation. Monitor security advisories.
Refer to the WPCasa plugin's official website or WordPress plugin repository for the latest security advisory and patch information.
上传你的依赖文件，立即了解此CVE和其他CVE是否影响你。