CVE-2025-0955: VidoRev Extensions Auth Bypass Flaw

CVE-2025-0955 Overview

CVE-2025-0955 affects the VidoRev Extensions plugin for WordPress. The vulnerability stems from a missing capability check on the vidorev_import_single_video AJAX action. All versions up to and including 2.9.9.9.9.9.5 are affected. Unauthenticated attackers can invoke the AJAX handler to import arbitrary YouTube videos into the target WordPress site. The weakness is classified under [CWE-862] Missing Authorization. The flaw does not expose sensitive data or affect availability, but it allows attackers to inject unwanted third-party video content into a site's media library and published posts.

Critical Impact
Unauthenticated attackers can import arbitrary YouTube videos into a WordPress site running the VidoRev Extensions plugin, enabling content pollution and potential SEO abuse.

Affected Products

VidoRev Extensions plugin for WordPress, all versions up to and including 2.9.9.9.9.9.5
WordPress sites bundling the VidoRev video theme distribution
Sites exposing /wp-admin/admin-ajax.php to unauthenticated network clients

Discovery Timeline

2025-03-14 - CVE-2025-0955 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-0955

Vulnerability Analysis

The VidoRev Extensions plugin registers the vidorev_import_single_video handler through the WordPress AJAX API. The handler is exposed on both the authenticated wp_ajax_ hook and the unauthenticated wp_ajax_nopriv_ hook without a corresponding capability check. WordPress requires developers to gate privileged actions with current_user_can() and to validate a nonce created by wp_create_nonce(). The plugin performs neither check before executing the video import logic. Any network client can therefore call the endpoint directly and trigger content ingestion. The impact is limited to integrity of site content, which is reflected in the low integrity subscore and the absence of confidentiality or availability impact.

Root Cause

The root cause is a missing authorization check in the AJAX callback [CWE-862]. The plugin trusts the request context and treats any caller as authorized to import videos. There is no role verification, no nonce validation, and no rate limiting on the endpoint.

Attack Vector

An attacker sends an HTTP POST request to wp-admin/admin-ajax.php with the action parameter set to vidorev_import_single_video and a YouTube video identifier as a payload. The plugin fetches the video metadata and stores it as a new post. No authentication, session cookie, or referer header is required. Attackers can script bulk imports to flood a site with attacker-chosen video content. Because the action runs from the server, imported entries appear as legitimate site content and may be indexed by search engines.

Detection Methods for CVE-2025-0955

Indicators of Compromise

Unexpected posts of the WordPress post_type associated with VidoRev containing YouTube URLs not sourced by site editors
HTTP POST requests to admin-ajax.php containing action=vidorev_import_single_video from unauthenticated clients
Spikes in outbound requests from the WordPress host to youtube.com or googleapis.com metadata endpoints
New media entries created by the nobody or 0 user ID rather than an editor account

Detection Strategies

Parse web server access logs for POST /wp-admin/admin-ajax.php events where the request body contains vidorev_import_single_video
Alert on AJAX actions invoked without a valid _wpnonce parameter or session cookie
Compare the count of imported videos against a baseline of editorial activity and flag deviations

Monitoring Recommendations

Enable WordPress audit logging to capture post creation events with source IP and user context
Forward web server and PHP-FPM logs to a centralized SIEM for correlation with authentication events
Monitor plugin version inventory across WordPress fleets to identify hosts still running VidoRev Extensions at or below 2.9.9.9.9.9.5

How to Mitigate CVE-2025-0955

Immediate Actions Required

Update the VidoRev Extensions plugin to a fixed release once the vendor publishes one, tracked through the Wordfence Vulnerability Report
Audit the WordPress posts table for unauthorized video entries and remove attacker-imported content
Restrict access to wp-admin/admin-ajax.php from untrusted networks where feasible

Patch Information

At the time of NVD publication no vendor patch was referenced. Site owners should monitor the ThemeForest Product Page and the Wordfence Vulnerability Report for a fixed release above 2.9.9.9.9.9.5.

Workarounds

Deactivate the VidoRev Extensions plugin until a patched version is available
Deploy a web application firewall rule that blocks requests to admin-ajax.php when the body contains action=vidorev_import_single_video from unauthenticated sources
Add a custom mu-plugin that unhooks wp_ajax_nopriv_vidorev_import_single_video to remove the unauthenticated entry point

bash

# Example WAF rule (ModSecurity) to block the vulnerable AJAX action
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
  "chain,phase:2,deny,status:403,id:1000955,msg:'Block CVE-2025-0955 VidoRev import'"
  SecRule REQUEST_BODY "@contains action=vidorev_import_single_video" \
    "chain"
    SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"