CVE-2025-11504: Quickcreator WordPress Plugin Info Leak

CVE-2025-11504 Overview

The Quickcreator – AI Blog Writer plugin for WordPress contains a Sensitive Information Exposure vulnerability that affects versions 0.0.9 through 0.1.17. The vulnerability exists due to the improper storage of sensitive API credentials in a publicly accessible text file located at /wp-content/plugins/quickcreator/dupasrala.txt. This misconfiguration allows unauthenticated attackers to retrieve the plugin's API key by simply navigating to this file path, enabling them to perform unauthorized actions on the affected WordPress site including creating new posts and injecting malicious XSS payloads.

Critical Impact

Unauthenticated attackers can retrieve exposed API keys to create unauthorized content and inject cross-site scripting (XSS) payloads, potentially compromising site visitors and administrative users.

Affected Products

• Quickcreator – AI Blog Writer plugin for WordPress versions 0.0.9 to 0.1.17

Discovery Timeline

• 2025-10-24 - CVE-2025-11504 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-11504

Vulnerability Analysis

This vulnerability is classified under CWE-532 (Insertion of Sensitive Information into Log File), indicating that sensitive data—specifically the plugin's API key—is written to a file that is accessible without authentication. The core issue stems from the plugin storing its API credentials in a plain text file (dupasrala.txt) within the plugin directory, which is typically web-accessible on standard WordPress installations.

Once an attacker obtains the API key, they gain the ability to interact with the plugin's functionality as if they were an authenticated administrator. This includes the capability to create, modify, or delete blog posts, and more critically, inject malicious JavaScript code through XSS payloads that could target site visitors or administrators.

Root Cause

The root cause of this vulnerability is the insecure storage of sensitive API credentials in a publicly accessible file within the WordPress plugin directory structure. Rather than storing API keys in the WordPress database with proper encryption or utilizing WordPress's native options API with appropriate access controls, the plugin writes these credentials to a plain text file that can be directly accessed via HTTP requests.

Attack Vector

The attack vector for this vulnerability is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by:

1. Identifying WordPress sites running the vulnerable Quickcreator plugin versions
2. Directly requesting the exposed file path at /wp-content/plugins/quickcreator/dupasrala.txt
3. Extracting the API key from the file contents
4. Using the stolen API key to authenticate to the plugin's API endpoints
5. Creating malicious content or injecting XSS payloads into the site

The attack is trivial to execute and can be automated at scale across vulnerable WordPress installations. No special tools or advanced knowledge are required—a simple web browser or curl command is sufficient to retrieve the exposed credentials.

Detection Methods for CVE-2025-11504

Indicators of Compromise

• Unexpected HTTP requests to /wp-content/plugins/quickcreator/dupasrala.txt in web server access logs
• Unauthorized blog posts appearing on the site, particularly those containing suspicious JavaScript code
• XSS payloads or malicious scripts embedded in post content created through the Quickcreator plugin
• API activity from unexpected IP addresses or geographic locations
• Unusual content creation patterns or bulk post creation events

Detection Strategies

• Monitor web server access logs for requests targeting the dupasrala.txt file path
• Implement file integrity monitoring on the WordPress wp-content/plugins/ directory
• Review recently created or modified posts for suspicious content or embedded scripts
• Set up alerts for API usage patterns that deviate from normal administrative behavior
• Deploy web application firewall (WAF) rules to detect and block access attempts to sensitive plugin files

Monitoring Recommendations

• Enable detailed access logging on the web server to capture all requests to plugin directories
• Configure SIEM alerts for HTTP 200 responses to requests containing dupasrala.txt in the path
• Implement content scanning for newly created posts to detect potential XSS payloads
• Review WordPress audit logs regularly for unauthorized content modifications
• Monitor for signs of credential abuse including API calls from unusual source IPs

How to Mitigate CVE-2025-11504

Immediate Actions Required

• Update the Quickcreator – AI Blog Writer plugin to a version newer than 0.1.17 if a patched version is available
• Immediately block access to the /wp-content/plugins/quickcreator/dupasrala.txt file via web server configuration
• Regenerate any API keys that may have been exposed through this vulnerability
• Review all content created through the plugin for signs of malicious injection
• Audit user accounts and access logs for signs of unauthorized activity

Patch Information

Organizations should check the WordPress Plugin Information page for the latest available version and update immediately. Additional vulnerability details and remediation guidance are available in the Wordfence Vulnerability Report. If no patched version is available, consider disabling or removing the plugin until a security update is released.

Workarounds

• Block direct access to the vulnerable file by adding deny rules in .htaccess or nginx configuration
• Consider temporarily deactivating the Quickcreator plugin until a security patch is available
• Implement web application firewall rules to block requests to sensitive plugin files
• Move the API key to WordPress's secure options storage if manual modification is feasible
• Restrict access to the wp-content/plugins/ directory at the web server level

# Apache .htaccess configuration to block access to the vulnerable file
<FilesMatch "dupasrala\.txt$">
    Require all denied
</FilesMatch>

# Nginx configuration to block access
location ~* /wp-content/plugins/quickcreator/dupasrala\.txt {
    deny all;
    return 403;
}