Auto x LINE Plugin EUVD-2025-210830

No special conditions - remote unauthenticated exploitation against any WordPress installation running the Auto x LINE plugin through version 1.0.0 with the plugin active. The WordPress REST API is enabled by default in all modern WordPress installations (4.7+), so no non-default configuration is required. The limiting factor is plugin adoption: only sites that have installed this specific LINE integration plugin are at risk. Exploitation is constrained to the impact scope of the plugin's stored credentials and log data - it does not directly grant wp-admin access or arbitrary file write, but LINE API credential theft may enable secondary attacks against the site's LINE channel.

The CVSS 8.2 score is supported by the attack profile: fully unauthenticated, network-reachable, low-complexity exploitation against a REST endpoint - no special conditions beyond the plugin being active. The C:H rating is credible given LINE API credentials stored in plugin settings. A publicly available PoC from WPScan raises real exploitation likelihood on any unpatched instance exposed to the internet. EPSS data was not provided, so exploitation probability cannot be quantitatively compared. No CISA KEV listing means confirmed mass exploitation is not yet observed, but the combination of PoC + unauthenticated REST exposure + credential theft potential makes this a prioritized remediation item for any site running this plugin. The I:L score may understate the integrity impact - an attacker who overwrites the LINE channel token can silently redirect all LINE-sourced messages to their own channel.

An unauthenticated attacker sends crafted HTTP GET or POST requests directly to the plugin's unprotected REST endpoints on any public WordPress site running Auto x LINE ≤1.0.0. The attacker first calls the settings-read endpoint to harvest the LINE channel access token and secret, then optionally calls the settings-write endpoint to substitute their own LINE credentials, silently redirecting all LINE communications through their controlled channel. A publicly available PoC from WPScan makes this attack trivially scriptable with no specialized tooling.