CVE-2025-11771mediumCWE-306

CVE-2025-11771: fallo de gravedad media en beycanpress Cryptocurrency (Token), Launchpad…

Cryptocurrency (Token), Launchpad (Presale), ICO & IDO, Airdrop by TokenICO <= 2.4.7 - Missing Authentication to Unauthenticated Presale Update

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Cryptocurrency, Launchpad, ICO & IDO, Airdrop by TokenICO

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.3epss 0.3%
The Cryptocurrency (Token), Launchpad (Presale), ICO & IDO, Airdrop by TokenICO plugin for WordPress is vulnerable to unauthenticated and unauthorized modification of data due to missing authentication and capability checks on the 'createSaleRecord' function in all versions up to, and including, 2.4.7. This makes it possible for unauthenticated attackers to manipulate presales counters.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Productos afectados
beycanpress · Cryptocurrency (Token), Launchpad (Presale), ICO & IDO, Airdrop by TokenICO
CVEs relacionadas — beycanpress Cryptocurrency (Token), Launchpad…

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-11773MEDIUMCryptocurrency (Token), Launchpad (Presale), ICO & IDO, Airdrop by TokenICO <= 2.4.7 - Missing Authorization to Authenticated (Subscriber+) Contract Address UpdateEPSS 0.2%