WordPress Plugin Vulnerabilities

Custom API for WP < 4.2.3 - Subscriber+ Privilege Escalation

Description

The plugin is vulnerable to Privilege Escalation due to the plugin not properly restricting a users ability to set roles. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges.

Affects Plugins

Plugin icon
custom-api-for-wp
Fixed in 4.2.3

References

CVE
CVE-2025-54049
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/55278cc8-338e-4583-9334-f91f94f22e13

Classification

Type
PRIVESC
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-269
CVSS
8.8 (high)

Miscellaneous

Original Researcher
Hiro
Verified
No
WPVDB ID
dba34d28-3517-4020-b57e-8168d19ed1ca

Timeline

Publicly Published
2025-07-28 (about 11 months ago)
Added
2025-08-05 (about 10 months ago)
Last Updated
2025-08-05 (about 10 months ago)

Other

Published
Title
Published
2025-02-11
Title
WP Job Board Pro < 1.2.82 - Unauthenticated Privilege Escalation
Published
2017-11-27
Title
Elementor Page Builder < 1.8.0 - Authenticated Unrestricted Editing
Published
2025-03-14
Title
uListing <= 2.1.7 - Subscriber+ Privilege Escalation
Published
2024-07-10
Title
JSON API User < 3.9.4 - Unauthenticated Privilege Escalation
Published
2024-07-01
Title
Ultimate Addons for Elementor < 1.36.32 - Authenticated (Contributor+) Privilege Escalation