CVE-2025-11988: WordPress Crypto Plugin Auth Bypass Flaw

CVE-2025-11988 Overview

CVE-2025-11988 affects the Crypto plugin for WordPress in all versions up to and including 2.22. The plugin registers an unauthenticated AJAX action, wp_ajax_nopriv_crypto_connect_ajax_process, that exposes the crypto_delete_json method behind a publicly available nonce check. Unauthenticated attackers can invoke this action to delete JSON files matching the *_pending.json pattern inside the wp-content/uploads/yak/ directory. The result is data loss and disruption of plugin workflows that depend on those artifacts. The issue is tracked under [CWE-862] Missing Authorization.

Critical Impact

Unauthenticated remote attackers can delete pending JSON artifacts used by the Crypto plugin, causing data loss and denial of service against affected WordPress sites.

Affected Products

• Crypto plugin for WordPress, all versions through 2.22
• WordPress sites exposing the wp_ajax_nopriv_crypto_connect_ajax_process action
• Deployments relying on *_pending.json artifacts in wp-content/uploads/yak/

Discovery Timeline

• 2025-11-11 - CVE-2025-11988 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11988

Vulnerability Analysis

The Crypto plugin exposes an AJAX endpoint through the WordPress wp_ajax_nopriv_ hook, which by design serves unauthenticated visitors. The endpoint routes requests to crypto_connect_ajax_process, which dispatches to internal methods including crypto_delete_json. The only gate protecting the deletion routine is a nonce that is served publicly to any site visitor, so the check does not establish a security boundary against unauthenticated callers.

When invoked, crypto_delete_json targets files under wp-content/uploads/yak/ whose names match the pattern *_pending.json. Attackers can enumerate the endpoint and issue repeated deletion requests, removing pending workflow artifacts that the plugin later expects to read. Loss of these artifacts breaks registration and processing flows that depend on their presence.

Root Cause

The root cause is missing authorization on a state-changing operation. The handler validates only a public nonce and does not enforce a capability check such as current_user_can() before allowing file deletion. Reference the plugin source at class-crypto_connect_ajax_register.php line 137 and line 9.

Attack Vector

The attack requires only network access to the WordPress site. An attacker retrieves a valid nonce from a public page rendered by the plugin, then issues a POST request to /wp-admin/admin-ajax.php with action=crypto_connect_ajax_process and parameters that trigger the crypto_delete_json branch. No authentication, user interaction, or elevated privileges are required. See the Wordfence Vulnerability Report for additional context.

Detection Methods for CVE-2025-11988

Indicators of Compromise

• Unexpected removal of files matching *_pending.json under wp-content/uploads/yak/
• POST requests to /wp-admin/admin-ajax.php with action=crypto_connect_ajax_process from unauthenticated sessions
• Plugin workflow errors referencing missing pending JSON artifacts after external HTTP activity

Detection Strategies

• Enable file integrity monitoring on the wp-content/uploads/yak/ directory and alert on delete events for *_pending.json
• Inspect web server access logs for repeated admin-ajax.php requests carrying crypto_connect_ajax_process from a single source
• Correlate deletion events with the referring source IP and User-Agent to identify scripted abuse

Monitoring Recommendations

• Ship WordPress access and PHP error logs to a central SIEM for retention and search
• Add an alert on any 200 response to admin-ajax.php where the action parameter equals crypto_connect_ajax_process
• Baseline normal request rates to the plugin endpoint and alert on statistically significant spikes

How to Mitigate CVE-2025-11988

Immediate Actions Required

• Update the Crypto plugin to a fixed version above 2.22 as soon as one is published by the maintainer
• Deactivate the Crypto plugin if a patched version is not yet available and the site can operate without it
• Restrict access to /wp-admin/admin-ajax.php for the crypto_connect_ajax_process action at the WAF or reverse proxy layer
• Back up the contents of wp-content/uploads/yak/ to enable restoration of any deleted *_pending.json files

Patch Information

At the time of publication, no fixed version is listed in the NVD entry. Monitor the WordPress plugin repository and the Wordfence advisory for release information and apply the vendor patch when available.

Workarounds

• Add a WAF rule that blocks unauthenticated POST requests to admin-ajax.php containing action=crypto_connect_ajax_process
• Set restrictive filesystem permissions on wp-content/uploads/yak/ so that only the web server user with least privilege can write, and monitor deletions
• Use a mu-plugin to remove the wp_ajax_nopriv_crypto_connect_ajax_process hook until an official fix is deployed

# Example WAF rule (ModSecurity) blocking the vulnerable AJAX action
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
  "chain,phase:2,deny,status:403,id:1011988,\
   msg:'Block CVE-2025-11988 crypto_connect_ajax_process'"
  SecRule ARGS:action "@streq crypto_connect_ajax_process" "t:none"