CVE-2025-11771mediumCWE-306

CVE-2025-11771: medium-severity vulnerability in beycanpress Cryptocurrency (Token), Launchpad…

Cryptocurrency (Token), Launchpad (Presale), ICO & IDO, Airdrop by TokenICO <= 2.4.7 - Missing Authentication to Unauthenticated Presale Update

Published · Updated

Follow this CVE+ Monitor Cryptocurrency, Launchpad, ICO & IDO, Airdrop by TokenICO

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 0.3%
The Cryptocurrency (Token), Launchpad (Presale), ICO & IDO, Airdrop by TokenICO plugin for WordPress is vulnerable to unauthenticated and unauthorized modification of data due to missing authentication and capability checks on the 'createSaleRecord' function in all versions up to, and including, 2.4.7. This makes it possible for unauthenticated attackers to manipulate presales counters.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected products
beycanpress · Cryptocurrency (Token), Launchpad (Presale), ICO & IDO, Airdrop by TokenICO
Related CVEs — beycanpress Cryptocurrency (Token), Launchpad…

In the same product, most dangerous first.

CVE-2025-11773MEDIUMCryptocurrency (Token), Launchpad (Presale), ICO & IDO, Airdrop by TokenICO <= 2.4.7 - Missing Authorization to Authenticated (Subscriber+) Contract Address UpdateEPSS 0.2%