WordPress Plugin Vulnerabilities

WPCasa < 1.4.2 - Unauthenticated Code Injection

Description

The WPCasa plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 1.4.1. This is due to insufficient input validation and restriction on the 'api_requests' function. This makes it possible for unauthenticated attackers to call arbitrary functions and execute code.

Affects Plugins

Plugin icon
wpcasa
Fixed in 1.4.2

References

CVE
CVE-2025-9321
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/c1001b2b-395a-44ee-827e-6e57f7a50218

Classification

Type
RCE
OWASP top 10
A1: Injection
CWE
CWE-94
CVSS
9.8 (critical)

Miscellaneous

Original Researcher
mikemyers
Verified
No
WPVDB ID
e108f5db-9f74-4b2e-8f02-ca7510b4fd54

Timeline

Publicly Published
2025-09-22 (about 11 months ago)
Added
2025-09-22 (about 11 months ago)
Last Updated
2025-09-23 (about 11 months ago)

Other

Published
Title
Published
2014-08-01
Title
Archin 3.2 - hades_framework/option_panel/ajax.php Configuration Option Manipulation
Published
2025-11-25
Title
Hotel Booking Lite < 5.2.4 - Authenticated (Hotel Worker+) Remote Code Execution
Published
2021-12-05
Title
WP Coder < 2.5.2 - RFI leading to RCE via CSRF
Published
2017-09-23
Title
Basic Contact Form <= 1.0.3 - Potential Unauthenticated Shell Upload
Published
2025-11-12
Title
Import any XML, CSV or Excel File to WordPress < 4.0.0 - Admin+ Remote Code Execution via Conditional Logic