What is the CVSS score of CVE-2025-5288?

CVE-2025-5288 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of PHP are affected by CVE-2025-5288?

A critical vulnerability in the WordPress REST API Custom API Generator plugin allows unauthenticated attackers to create administrator accounts without authorization, effectively giving them…

How to fix or mitigate CVE-2025-5288?

Within 24 hours: Identify all WordPress instances running the affected plugin (versions 1.0.0-2.0.3) and disable or remove it immediately. Within 7 days: Audit user accounts for unauthorized administrator creations, review access logs for exploitation attempts, and audit all content modifications. Within 30 days: Select and implement an alternative plugin solution, establish a plugin inventory and patch management process, and conduct a security assessment of the compromised WordPress environment.

PHP CVE-2025-5288

EUVD-2025-18240 CRITICAL

Missing Authorization (CWE-862)

2025-06-13 security@wordfence.com

WordPress Privilege Escalation PHP

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 21:34 euvd

EUVD-2025-18240

Analysis Generated

Mar 14, 2026 - 21:34 vuln.today

CVE Published

Jun 13, 2025 - 03:15 nvd

CRITICAL 9.8

DescriptionCVE.org

The REST API | Custom API Generator For Cross Platform And Import Export In WP plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the process_handler() function in versions 1.0.0 to 2.0.3. This makes it possible for unauthenticated attackers to POST an arbitrary import_api URL, import specially crafted JSON, and thereby create a new user with full Administrator privileges.

AnalysisAI

The REST API | Custom API Generator For Cross Platform And Import Export plugin for WordPress (versions 1.0.0-2.0.3) contains a critical privilege escalation vulnerability where the process_handler() function lacks capability checks, allowing unauthenticated attackers to create administrator accounts via malicious JSON imports. With a CVSS score of 9.8 and network-based attack vector requiring no user interaction, this is a severe, likely actively exploited vulnerability affecting any WordPress installation using vulnerable plugin versions.

Technical ContextAI

The vulnerability exists in a WordPress REST API plugin that generates custom API endpoints for data import/export functionality. The root cause is CWE-862 (Missing Authorization/Capability Check), where the process_handler() function fails to validate WordPress capabilities (wp_verify_nonce, current_user_can) before processing POST requests to the import_api endpoint. The plugin accepts arbitrary URLs via the import_api parameter and processes JSON payloads without authentication, directly instantiating user objects with administrator role assignment. This bypasses WordPress's standard privilege escalation protections, which rely on authenticated sessions and role-based access control (RBAC). The affected component is the custom REST endpoint handler, likely registered via add_rest_route() without proper permission callbacks.

RemediationAI

IMMEDIATE ACTIONS: (1) Update plugin to version 2.0.4 or later if available (patch release containing authorization checks on process_handler()); (2) If patch unavailable, disable/deactivate the plugin immediately and remove from wp-content/plugins/; (3) Conduct emergency audit of WordPress user accounts created after plugin installation—check wp_users table for suspicious admin accounts created via REST API. MITIGATION (if patch delay): Restrict access to wp-json endpoints via .htaccess (deny all wp-json/* POST requests from non-authenticated IPs), or use WordPress security plugins to block unauthenticated REST API POST requests. DETECTION: Search wp-admin audit logs and wp_users table for accounts created via REST API endpoint with empty referrer. CHECK VENDOR ADVISORY: Review WordPress.org plugin repository page for CVE-2025-5288 patch notes and changelog for confirmed patch version.