WordPress Plugin Vulnerabilities

Ultimate Auction < 4.3.4 - Unauthenticated Information Exposure

Description

The Ultimate WordPress Auction Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.3.3. This makes it possible for unauthenticated attackers to extract sensitive user or configuration data.

Affects Plugins

Plugin icon
ultimate-auction
Fixed in 4.3.4

References

CVE
CVE-2025-66125
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/f5733ed6-a6f8-40f1-80b2-ab09fca02791

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
daroo
Verified
No
WPVDB ID
7129159c-66d0-487f-8327-d33fd5ca6a22

Timeline

Publicly Published
2025-12-12 (about 8 months ago)
Added
2025-12-19 (about 8 months ago)
Last Updated
2026-08-14 (about 11 days ago)

Other

Published
Title
Published
2025-11-26
Title
All In One SEO Pack < 4.8.7 - Subscriber+ Information Exposure
Published
2026-08-19
Title
Copy & Delete Posts < 1.5.6 - Authenticated Arbitrary Post Content and Password Disclosure
Published
2026-03-27
Title
Ultimate Member < 2.11.3 - Contributor+ Account Takeover via Shortcode Template Tag
Published
2024-04-22
Title
WP Fusion Lite – Marketing Automation and CRM Integration for WordPress < 3.43.0 - Information Exposure
Published
2024-12-17
Title
Animation Addons for Elementor < 1.1.7 - Authenticated (Contributor+) Sensitive Information Exposure via Content Slider and Tabs Widget Elementor Template