CVEvulnerability
CVE-2025-14864
4.3 MEDIUM
Official page ↗
- Status
- Deferred
- Published
- 2026-02-19
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weaknesses
- CWE-862
Description
The Virusdie - One-click website security plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.1.7. This is due to missing capability checks on the `vd_get_apikey` function which is hooked to `wp_ajax_virusdie_apikey`. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve the site's Virusdie API key, which could be used to access the site owner's Virusdie account and potentially compromise site security.
Related
Weakness · CWE (1)
- CWE-862 Missing Authorization weakness
References
- https://plugins.trac.wordpress.org/browser/virusdie/trunk/inc/class-virusdie.php#L75 plugins.trac.wordpress.org
- https://plugins.trac.wordpress.org/browser/virusdie/trunk/inc/tools/class-virusdie-behavior.php#L240 plugins.trac.wordpress.org
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3450727%40virusdie&new=3450727%40virusdie&sfp_email=&sfph_mail= plugins.trac.wordpress.org
- https://www.wordfence.com/threat-intel/vulnerabilities/id/8ef2e0b1-52ef-4f70-9e95-d010a586d060?source=cve www.wordfence.com