What is the CVSS score of CVE-2025-15485?

CVE-2025-15485 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.2%.

Which versions of Auto x LINE Plugin are affected by CVE-2025-15485?

The Auto x LINE WordPress plugin (versions through 1.0.0) contains a critical missing authorization flaw allowing unauthenticated remote attackers to read and modify plugin settings, including LINE…

Is there a public PoC exploit available for CVE-2025-15485?

Yes, a public proof-of-concept exploit is available for CVE-2025-15485. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2025-15485?

Within 24 hours, identify all WordPress installations running the Auto x LINE plugin and deactivate it if not operationally critical. Within 7 days, if the plugin is necessary for operations, implement interim controls by deploying a Web Application Firewall (WAF) to block unauthenticated REST API requests to the plugin's endpoints, and immediately revoke all LINE API credentials and channel tokens associated with the WordPress site, regenerating new credentials after remediation is complete. Within 30 days, monitor the Auto x LINE repository and WPScan for vendor security updates; if no patch is released, evaluate migration to an alternative LINE integration plugin with confirmed authorization controls, or redevelop the integration using LINE's official API with proper authentication mechanisms.

Auto x LINE Plugin CVE-2025-15485

EUVD-2025-210830 HIGH

Missing Authorization (CWE-862)

2026-09-02 WPScan

GHSA-c47c-7wwv-x7m2

WordPress Authentication Bypass Auto X Line Unknown

8.2

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

vuln.today AI

8.2 HIGH

Unauthenticated REST endpoint, network-reachable by default; C:H for likely credential exposure; I:L for settings overwrite; A:N as no service disruption described.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

POC Analysis Generated

Sep 02, 2026 - 15:21 vuln.today

Analysis Generated

Sep 02, 2026 - 15:10 vuln.today

CVE Published

Sep 02, 2026 - 14:25 cve.org

HIGH 8.2

DescriptionCVE.org

The Auto x LINE WordPress plugin through 1.0.0 does not have authorization checks in some of its REST endpoints, allowing unauthenticated users to call them and update the plugin settings, clear logs etc

AnalysisAI

Missing authorization on REST API endpoints in the Auto x LINE WordPress plugin (through version 1.0.0) allows unauthenticated remote attackers to read and modify plugin settings and erase log data. The plugin facilitates LINE messaging integration for WordPress sites, meaning exposed settings likely include LINE API credentials and channel tokens. A publicly available proof-of-concept exists per WPScan, and the unauthenticated network-accessible nature of the flaw (PR:N, AV:N) makes it trivially exploitable against any exposed instance. No actively exploited status confirmed in CISA KEV at time of analysis.

Technical ContextAI

The Auto x LINE plugin (CPE: cpe:2.3:a:unknown:auto_x_line:*:*:*:*:*:*:*:*) integrates WordPress with the LINE messaging platform API. It registers WordPress REST API endpoints that lack proper capability checks - the WordPress standard being current_user_can() guards on register_rest_route() callbacks. Without these checks, any unauthenticated HTTP client can invoke the endpoints directly. The root cause aligns with CWE-862 (Missing Authorization), though NVD has left CWE unassigned. The CVSS C:H signal implies that plugin settings surfaced via these endpoints likely include sensitive LINE channel credentials (channel access tokens, channel secrets) that would give an attacker control over the site's LINE integration. The I:L metric reflects the ability to overwrite settings or clear audit logs.

RemediationAI

No vendor-released patched version is identified in the available data - the WPScan advisory does not cite a fixed release, and the plugin version ceiling is stated as 'through 1.0.0.' Administrators should immediately deactivate and remove the plugin until a patched version is released or authorization checks are confirmed added by the developer. As a compensating control, restrict access to WordPress REST API routes at the web server or WAF layer (e.g., block external requests to /wp-json/ paths associated with this plugin) - note this may disrupt legitimate plugin functionality. Monitor the WPScan advisory at https://wpscan.com/vulnerability/3e9da619-bce1-49b5-aa35-dce22b72f9e6/ and the WordPress plugin repository for an updated release. If the plugin must remain active, rotate LINE channel access tokens and secrets immediately to limit the window of credential exposure.