CVE-2025-11986: WordPress Crypto Plugin Auth Bypass Flaw

CVE-2025-11986 Overview

CVE-2025-11986 affects the Crypto plugin for WordPress in all versions up to and including 2.22. The plugin registers an unauthenticated AJAX action wp_ajax_nopriv_crypto_connect_ajax_process that exposes the register and savenft methods to any site visitor. The endpoint validates only a publicly available nonce and skips wallet signature verification. Attackers can set a site-wide global authentication state through a single transient, bypassing [crypto-block] shortcode restrictions and page-level access controls for every visitor. The condition persists for one hour and lets attackers inject arbitrary rows into the plugin's custom_users table. The issue is tracked under [CWE-306] Missing Authentication for Critical Function.

Critical Impact
Unauthenticated attackers can bypass all crypto-block access controls site-wide for one hour and write arbitrary data into the plugin's user table.

Affected Products

WordPress Crypto plugin versions up to and including 2.22
Sites relying on [crypto-block] shortcode for gated content
WordPress installations using the plugin's custom_users table for wallet-based authentication

Discovery Timeline

2025-11-11 - CVE-2025-11986 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11986

Vulnerability Analysis

The Crypto plugin exposes wallet-connect functionality through an AJAX endpoint that WordPress treats as public. The wp_ajax_nopriv_crypto_connect_ajax_process hook routes requests from unauthenticated visitors into the register and savenft methods. These methods normally exist to finalize a wallet-based sign-in, so they establish the authenticated session state for the caller. The plugin does not verify that the caller controls the wallet address supplied in the request. A visitor can therefore claim any wallet identifier and have the plugin persist a global authentication transient. That transient is not scoped to a session, cookie, or IP address, so every subsequent visitor inherits the authenticated state until the transient expires after one hour.

Root Cause

The root cause is missing authentication on a state-changing function [CWE-306]. The crypto_connect_ajax_process handler relies on a wp_create_nonce value that any anonymous visitor can retrieve from a rendered page. There is no cryptographic proof that the request originates from the owner of the claimed wallet, and no per-user isolation of the resulting authentication state. See the WordPress plugin source at class-crypto_connect_ajax_register.php line 9, line 65, line 95, and class-crypto-user.php line 95.

Attack Vector

An unauthenticated attacker fetches any public page to obtain the plugin nonce, then submits a POST request to admin-ajax.php invoking the crypto_connect_ajax_process action with the register or savenft method and an attacker-controlled wallet address. The plugin stores a global authentication transient and inserts a record into the custom_users table. Every visitor to the site is then treated as authenticated by the plugin's access-control logic for the next hour. The vulnerability manifests entirely over HTTP with no user interaction. Refer to the Wordfence Vulnerability Report for the disclosed exploitation path.

Detection Methods for CVE-2025-11986

Indicators of Compromise

POST requests to wp-admin/admin-ajax.php with the parameter action=crypto_connect_ajax_process originating from unauthenticated clients
Requests containing method parameters register or savenft accompanied by arbitrary wallet address values
Unexpected rows in the plugin's custom_users database table containing attacker-supplied wallet identifiers
Presence of a site-wide authentication transient tied to the Crypto plugin when no legitimate wallet login has occurred

Detection Strategies

Review web server access logs for anonymous admin-ajax.php POST requests targeting the crypto_connect_ajax_process action
Audit the custom_users table for records created outside of expected user registration windows
Alert on visitors gaining access to [crypto-block] gated content without a corresponding wallet-signature flow

Monitoring Recommendations

Enable WordPress query and object-cache logging to capture transient writes triggered by the plugin
Forward WordPress and web server logs to a central SIEM and correlate anomalous AJAX activity with content-access events
Track the installed version of the Crypto plugin across managed WordPress sites and flag any instance at 2.22 or earlier

How to Mitigate CVE-2025-11986

Immediate Actions Required

Update the Crypto plugin to a version later than 2.22 as soon as a patched release is available from the vendor
Deactivate and remove the Crypto plugin on sites that rely on [crypto-block] shortcodes for gated content until a fix is applied
Purge any authentication transients created by the plugin and audit the custom_users table for unauthorized entries

Patch Information

No fixed version is identified in the NVD record at the time of publication. Site operators should monitor the WordPress plugin repository and the Wordfence advisory for a patched release above version 2.22 and update immediately once available.

Workarounds

Block unauthenticated POST requests to admin-ajax.php where the action parameter equals crypto_connect_ajax_process at the web application firewall
Restrict access to admin-ajax.php by IP allowlist on sites that do not require anonymous AJAX from visitors
Replace [crypto-block] gating with an alternative access-control mechanism until the plugin is patched

bash

# Example WAF rule (ModSecurity) to block the vulnerable AJAX action
SecRule REQUEST_METHOD "@streq POST" \
  "chain,id:1011986,phase:2,deny,status:403,log,msg:'CVE-2025-11986 Crypto plugin unauth AJAX blocked'"
  SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
    "chain"
    SecRule ARGS:action "@streq crypto_connect_ajax_process" "t:lowercase"