CVE-2025-11771 Overview
CVE-2025-11771 affects the Cryptocurrency (Token), Launchpad (Presale), ICO & IDO, Airdrop by TokenICO plugin for WordPress. The vulnerability exists in all versions up to and including 2.4.7. The createSaleRecord function lacks authentication and capability checks, allowing unauthenticated attackers to modify presale counter data over the network. The flaw is classified under [CWE-306: Missing Authentication for Critical Function].
Critical Impact
Unauthenticated attackers can manipulate presale sale records on affected WordPress sites, distorting counters that may influence investor decisions and token sale integrity.
Affected Products
- TokenICO Cryptocurrency Launchpad plugin for WordPress versions 2.4.7 and earlier
- WordPress sites running the TokenICO presale/ICO/IDO plugin
- Token sale operators relying on the plugin's REST API endpoints
Discovery Timeline
- 2025-11-21 - CVE-2025-11771 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-11771
Vulnerability Analysis
The vulnerability resides in the createSaleRecord function exposed through the plugin's REST API in app/RestAPI.php. The function registers a callable endpoint without a permission_callback that verifies user authentication or capability. As a result, any unauthenticated remote actor can invoke the endpoint and write sale records that increment the presale counters.
While the impact is limited to integrity of presale data, the affected data drives visible counters on ICO landing pages. Attackers can inflate or falsify recorded contributions, misleading site visitors and potentially manipulating market behavior tied to the token sale.
Root Cause
The root cause is a missing authorization check on a state-changing REST API route. WordPress register_rest_route calls require an explicit permission_callback; when developers return true or omit proper capability validation, endpoints become publicly writable. Version 2.4.6 and prior expose createSaleRecord in this manner, as documented in the WordPress Plugin Code Review.
Attack Vector
Exploitation requires only network access to the target WordPress site. An attacker sends a crafted HTTP request to the plugin's REST endpoint that maps to createSaleRecord, supplying parameters that trigger a new sale record entry. No credentials, tokens, or user interaction are required.
The vulnerability manifests in the REST route handler that accepts and persists sale record parameters without validating the caller. Refer to the Wordfence Vulnerability Analysis for additional technical detail.
Detection Methods for CVE-2025-11771
Indicators of Compromise
- Unexpected POST requests to WordPress REST API routes registered by the tokenico-cryptocurrency-token-launchpad-presale-ico-ido-airdrop plugin
- Sudden increases in recorded presale entries without corresponding blockchain transaction confirmations
- Sale record entries originating from IP addresses not associated with legitimate buyers
Detection Strategies
- Review web server access logs for unauthenticated requests to /wp-json/ paths tied to the TokenICO plugin
- Correlate new database rows in the plugin's sale-records table against verified on-chain transactions
- Alert on anomalies in presale counter growth rates versus expected traffic patterns
Monitoring Recommendations
- Enable WordPress REST API request logging with source IP and user context captured
- Monitor for HTTP 200 responses to the createSaleRecord endpoint from unauthenticated sessions
- Track plugin version inventory across managed WordPress deployments to identify vulnerable installs
How to Mitigate CVE-2025-11771
Immediate Actions Required
- Update the TokenICO plugin to a version later than 2.4.7 as soon as the vendor publishes a fixed release
- Audit existing sale records for entries created after the plugin was installed to identify potentially fraudulent data
- Restrict access to the WordPress REST API via a Web Application Firewall (WAF) rule blocking unauthenticated calls to the affected endpoint
Patch Information
Review the WordPress Plugin Changeset for the developer's remediation commit and upgrade to the latest available plugin version through the WordPress admin dashboard.
Workarounds
- Deactivate the TokenICO plugin until a patched version is installed and verified
- Deploy a WAF rule that blocks POST requests to the plugin's createSaleRecord REST route from unauthenticated clients
- Restrict access to /wp-json/ endpoints by source IP where feasible during active presale campaigns
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
