Droip
CVE-2025-5835
HIGH
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | High-severity privilege escalation affecting authenticated WordPress users. CVSS 8.8 reflects broad impact: arbitrary post/user manipulation, settings tampering. Subscriber-level access sufficient to trigger damage. Organizations with Droip installations face immediate operational risk; admin functions exposed to low-privileged users. Patch urgency is critical given plugin's typical installation scale. |
| Exploit ScenarioDerived | Authenticated attacker with Subscriber role calls droip_post_apis() AJAX function via HTTP request, bypassing capability checks. Executes arbitrary post deletion, creation, or user account modifications without admin authentication. No public exploit identified at time of analysis; straightforward technical requirement given missing authorization validation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 08, 2026
Missing authorization in Droip plugin for WordPress (all versions ≤2.2.6) allows authenticated attackers with Subscriber-level privileges to manipulate content and settings via droip_post_apis() AJAX handler. Exploitable actions include arbitrary post deletion/creation, post duplication, settings modification, and user account manipulation. Requires only low-privilege authenticated access (PR:L) for high-impact compromise of confidentiality, integrity, and availability (CVSS 8.8). No public exploit identified at time of analysis.
RemediationAI
Update to Droip version 2.2.7 or later if available from vendor. Verify patch implementation by testing that subscriber-level accounts cannot access administrative AJAX endpoints. If patched version not yet released, temporarily deactivate the Droip plugin until vendor releases security update. Monitor vendor advisory at https://droip.com/ for official patch announcements. Audit existing installations for unauthorized post modifications, deletions, or user account changes performed by low-privileged accounts. Review Wordfence intelligence at https://www.wordfence.com/threat-intel/vulnerabilities/id/e2e6b451-9835-4887-ade7-b18807223a88?source=cve for additional technical details and indicators of compromise. Implement defense-in-depth by restricting subscriber account creation and reviewing role assignments.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Root cause is CWE-862 missing capability check in droip_post_apis() function, enabling low-privileged subscribers to invoke AJAX hooks that bypass WordPress role-based access controls. Function acts as gateway to privileged operations without validating user permissions, violating principle of complete mediation for administrative actions.
Know when Droip gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
The Droip plugin for WordPress is vulnerable to unauthorized modification and access of data due to a missing capability check on the droip_post_apis() function in all versions up to, and including, 2.2.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform many actions as the AJAX hooks to several functions. Some potential impacts include arbitrary post deletion, arbitrary post creation, post duplication, settings update, user manipulation, and much more.
Executive ViewAI
The Droip WordPress plugin (versions ≤2.2.6) contains a critical authorization flaw that allows any subscriber-level user to perform administrative actions including arbitrary post deletion, creation, and account manipulation without proper permission checks. Organizations using this plugin face immediate risk of content destruction, unauthorized modifications, and potential account takeover by low-privilege insiders or attackers who gain subscriber access.
Interim mitigations: (1) Disable Droip plugin entirely until patch released; (2) Restrict subscriber role to view-only permissions, removing create/edit/delete post capabilities via WordPress role editor; (3) Implement WordPress user audit logging for all administrative actions; (4) Monitor for suspicious post deletions and user account changes; (5) Remove unnecessary subscriber accounts. No vendor-released patch identified at time of analysis-patch unavailability necessitates compensating controls or plugin replacement.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Affected Products (CPE)CVE.org
Unauthenticated path traversal in Themeum's Droip WordPress plugin (versions prior to 2.5.2) lets remote attackers read
Arbitrary file upload in Themeum Droip WordPress plugin (versions up to 2.5.1) permits authenticated attackers with Subs
Missing Authorization vulnerability in Themeum Droip droip allows Exploiting Incorrectly Configured Access Control Secur
GitHub PoC
Exploit-DB