EUVD-2025-16984Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
The HyperComments plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the hc_request_handler function in all versions up to, and including, 1.2.2. This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
AnalysisAI
The HyperComments WordPress plugin versions up to 1.2.2 contain a critical missing capability check vulnerability in the hc_request_handler function that allows unauthenticated remote attackers to modify arbitrary WordPress options without authentication. This can be directly exploited to escalate privileges by changing the default registration role to administrator and enabling user registration, granting attackers immediate administrative access to vulnerable sites. With a CVSS score of 9.8 and network-based attack vector requiring no user interaction, this vulnerability poses an extreme risk to any unpatched WordPress installation using the affected plugin.
Technical ContextAI
The vulnerability exists in the HyperComments plugin for WordPress, a third-party plugin that extends WordPress comment functionality. The root cause is CWE-862 (Missing Authorization / Capability Check), where the hc_request_handler AJAX action handler fails to verify that the requesting user possesses the required WordPress capability (typically 'manage_options') before processing requests to modify site options. WordPress uses a role-based access control system where 'manage_options' capability is typically restricted to administrators. By exploiting the missing capability check on this publicly-accessible AJAX endpoint, unauthenticated attackers can invoke the handler without authentication and directly call update_option() functions to modify critical WordPress configuration. The attack leverages WordPress's standard option update mechanisms against the plugin's insufficient input validation and authorization controls.
RemediationAI
Immediate remediation steps: (1) Update the HyperComments plugin to version 1.2.3 or later (if available) or the latest stable release from the official WordPress.org plugin repository, as the vendor should have released a patch adding proper capability checks; (2) If no patch is available or delay is expected, immediately deactivate and remove the HyperComments plugin; (3) Review WordPress site options, particularly the default user role (option_name: 'default_role') and user registration settings (option_name: 'users_can_register') for unauthorized modifications; (4) Audit administrator user accounts for unauthorized additions created post-exploitation; (5) Implement WordPress security hardening: enable two-factor authentication for all admin accounts, restrict AJAX endpoints via security plugins, and implement capability-based access controls. Recommended workaround during patch delay: disable user registration on Settings > General and restrict AJAX handler access via .htaccess or firewall rules blocking requests to wp-admin/admin-ajax.php?action=hc_request_handler. Monitor plugin repository for official patch notification and release notes detailing the authorization fix.
More from same product – last 7 days
The WP MAPS PRO WordPress plugin before 6.1.1 registers an unauthenticated AJAX action which, given a valid nonce that i
Remote code execution in UpdraftPlus: WP Backup & Migration Plugin for WordPress (versions ≤1.26.4) allows unauthenticat
The weMail: Email Marketing, Email Automation, Newsletters, Subscribers & Email Optins for WooCommerce WordPress plugin
The Taskbuilder WordPress plugin before 5.0.8 does not properly sanitise a URL parameter before echoing it into inline
Remote code execution in Edgar Rojas WooCommerce PDF Invoice Builder WordPress plugin (versions through 2.0.8) allows un
Share
External POC / Exploit Code
Leaving vuln.today