{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-0955", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-01-31T20:04:06.880Z", "datePublished": "2025-03-14T04:22:34.484Z", "dateUpdated": "2026-04-08T17:30:40.394Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:30:40.394Z"}, "affected": [{"vendor": "beeteam368", "product": "VidoRev Extensions", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.9.9.9.9.9.5", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The VidoRev Extensions plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'vidorev_import_single_video' AJAX action in all versions up to, and including, 2.9.9.9.9.9.5. This makes it possible for unauthenticated attackers to import arbitrary youtube videos."}], "title": "VidoRev Extensions <= 2.9.9.9.9.9.5 - Missing Authorization to Unauthenticated Youtube Video Import", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e8c15662-e4df-4a74-bb01-266eeb4879c5?source=cve"}, {"url": "https://themeforest.net/item/vidorev-video-wordpress-theme/21798615"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Lucio S\u00e1"}], "timeline": [{"time": "2025-03-13T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-03-14T13:46:14.709627Z", "id": "CVE-2025-0955", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-14T13:46:39.891Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-0955", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-03-14T13:46:14.709627Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-14T13:46:24.848Z"}}], "cna": {"title": "VidoRev Extensions <= 2.9.9.9.9.9.5 - Missing Authorization to Unauthenticated Youtube Video Import", "credits": [{"lang": "en", "type": "finder", "value": "Lucio S\u00e1"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "beeteam368", "product": "VidoRev Extensions", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.9.9.9.9.9.5"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-03-13T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e8c15662-e4df-4a74-bb01-266eeb4879c5?source=cve"}, {"url": "https://themeforest.net/item/vidorev-video-wordpress-theme/21798615"}], "descriptions": [{"lang": "en", "value": "The VidoRev Extensions plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'vidorev_import_single_video' AJAX action in all versions up to, and including, 2.9.9.9.9.9.5. This makes it possible for unauthenticated attackers to import arbitrary youtube videos."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:30:40.394Z"}}}, "cveMetadata": {"cveId": "CVE-2025-0955", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:30:40.394Z", "dateReserved": "2025-01-31T20:04:06.880Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-03-14T04:22:34.484Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The VidoRev Extensions plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'vidorev_import_single_video' AJAX action in all versions up to, and including, 2.9.9.9.9.9.5. This makes it possible for unauthenticated attackers to import arbitrary youtube videos."}, {"lang": "es", "value": "El complemento VidoRev Extensions para WordPress es vulnerable al acceso no autorizado debido a la falta de comprobaci\u00f3n de la acci\u00f3n AJAX \u00abvidorev_import_single_video\u00bb en todas las versiones hasta la 2.9.9.9.9.9.5 incluida. Esto permite que atacantes no autenticados importen v\u00eddeos de YouTube arbitrarios."}], "id": "CVE-2025-0955", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2025-03-14T05:15:41.760", "references": [{"source": "security@wordfence.com", "url": "https://themeforest.net/item/vidorev-video-wordpress-theme/21798615"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e8c15662-e4df-4a74-bb01-266eeb4879c5?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T21:56:32.560405+00:00", "value": {"mitigation_remediation": ["Upgrade VidoRev Extensions to the latest stable release that implements a proper capability check for the vidorev_import_single_video action.", "If an updated version is not available, disable the single-video import feature or remove the plugin entirely until a fix is released.", "Restrict the AJAX endpoint by configuring a web application firewall rule that blocks unauthenticated POST requests targeting the vidorev_import_single_video action."], "summary": {"action": "Patch", "impact": "Unauthorized Access"}, "threat_synthesis": {"affected_systems": "The flaw affects the WordPress plugin VidoRev Extensions distributed by beeteam368. All releases with versions up to and including 2.9.9.9.9.9.5 are susceptible. Sites employing this plugin and exposing the AJAX endpoint should evaluate their exposure.", "description_and_impact": "The vulnerability in VidoRev Extensions up to 2.9.9.9.9.9.5 stems from a missing capability check on the 'vidorev_import_single_video' AJAX action, permitting unauthenticated users to import arbitrary YouTube videos. This unauthorized data import can expose a site to unwanted or malicious content, exemplifying a classic missing authorization flaw (CWE-862).", "risk_and_exploitability": "The CVSS score of 5.3 indicates moderate risk; the EPSS score is less than 1\u202f%, reflecting a very low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is likely through the publicly reachable '/wp-admin/admin-ajax.php' endpoint; an attacker can simply send an unauthenticated HTTP request to trigger the import action, requiring no privileged credentials or complex setup."}}}}, "created": "2025-07-13T11:07:26.299496+00:00", "updated": "2026-04-21T22:00:26.598810+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}