What is the CVSS score of CVE-2025-5835?

CVE-2025-5835 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Droip are affected by CVE-2025-5835?

The Droip WordPress plugin (versions ≤2.2.6) contains a critical authorization flaw that allows any subscriber-level user to perform administrative actions including arbitrary post deletion,…

How to fix or mitigate CVE-2025-5835?

Within 24 hours: Inventory all WordPress installations using Droip plugin and document current version numbers; disable the plugin immediately via WordPress admin or file system if version ≤2.2.6 is confirmed. Within 7 days: Contact Droip vendor for patch availability timeline and evaluate alternative plugins; restrict subscriber role permissions to minimum necessary capabilities as interim control. Within 30 days: Apply vendor patch immediately upon release to version >2.2.6, or migrate to patched alternative plugin; conduct audit of post and user modifications during vulnerability window if plugin was active.

Droip CVE-2025-5835

HIGH

Missing Authorization (CWE-862)

2025-07-25 security@wordfence.com

WordPress Authentication Bypass Droip

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 08, 2026 - 19:39 vuln.today

CVE Published

Jul 25, 2025 - 07:15 nvd

HIGH 8.8

DescriptionCVE.org

The Droip plugin for WordPress is vulnerable to unauthorized modification and access of data due to a missing capability check on the droip_post_apis() function in all versions up to, and including, 2.2.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform many actions as the AJAX hooks to several functions. Some potential impacts include arbitrary post deletion, arbitrary post creation, post duplication, settings update, user manipulation, and much more.

AnalysisAI

Missing authorization in Droip plugin for WordPress (all versions ≤2.2.6) allows authenticated attackers with Subscriber-level privileges to manipulate content and settings via droip_post_apis() AJAX handler. Exploitable actions include arbitrary post deletion/creation, post duplication, settings modification, and user account manipulation. Requires only low-privilege authenticated access (PR:L) for high-impact compromise of confidentiality, integrity, and availability (CVSS 8.8). No public exploit identified at time of analysis.

Technical ContextAI

Root cause is CWE-862 missing capability check in droip_post_apis() function, enabling low-privileged subscribers to invoke AJAX hooks that bypass WordPress role-based access controls. Function acts as gateway to privileged operations without validating user permissions, violating principle of complete mediation for administrative actions.

RemediationAI

Update to Droip version 2.2.7 or later if available from vendor. Verify patch implementation by testing that subscriber-level accounts cannot access administrative AJAX endpoints. If patched version not yet released, temporarily deactivate the Droip plugin until vendor releases security update. Monitor vendor advisory at https://droip.com/ for official patch announcements. Audit existing installations for unauthorized post modifications, deletions, or user account changes performed by low-privileged accounts. Review Wordfence intelligence at https://www.wordfence.com/threat-intel/vulnerabilities/id/e2e6b451-9835-4887-ade7-b18807223a88?source=cve for additional technical details and indicators of compromise. Implement defense-in-depth by restricting subscriber account creation and reviewing role assignments.