CVE-2025-23971: KI Live Video Conferences Auth Bypass

CVE-2025-23971 Overview

CVE-2025-23971 is a missing authorization vulnerability in the whassan KI Live Video Conferences WordPress plugin (ki-live-video-conferences). The flaw affects all versions up to and including 5.5.15. It stems from incorrectly configured access control security levels, allowing unauthenticated attackers to reach plugin functionality that should be restricted. The issue is tracked as CWE-862: Missing Authorization and carries an EPSS probability of 0.273% (percentile 19.134).

Critical Impact
Unauthenticated attackers can invoke restricted plugin actions over the network, resulting in limited integrity impact on affected WordPress sites.

Affected Products

whassan KI Live Video Conferences plugin for WordPress
All versions from n/a through <= 5.5.15
WordPress sites with the ki-live-video-conferences plugin installed and active

Discovery Timeline

2025-06-06 - CVE-2025-23971 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-23971

Vulnerability Analysis

The KI Live Video Conferences plugin exposes one or more actions without adequate authorization checks. In WordPress plugins, this pattern typically appears when handlers registered through admin-post.php, admin-ajax.php, or the REST API omit capability checks such as current_user_can() and rely only on nonce verification or authentication state. Attackers reach these endpoints directly over HTTP and trigger plugin logic intended for privileged users. The vulnerability produces a limited integrity impact without affecting confidentiality or availability, according to the published CVSS vector.

Root Cause

The root cause is a broken access control implementation categorized under CWE-862. The plugin does not enforce the correct security level on sensitive actions. Missing authorization checks let low-privilege or unauthenticated requests execute functions that should require an administrator or editor role.

Attack Vector

Exploitation requires no authentication, no user interaction, and low attack complexity. An attacker sends crafted HTTP requests to the vulnerable plugin endpoints exposed by a WordPress installation running ki-live-video-conferences <= 5.5.15. Successful requests modify plugin-controlled data or state within the site. Refer to the Patchstack Vulnerability Report for advisory details.

Detection Methods for CVE-2025-23971

Indicators of Compromise

Unauthenticated POST or GET requests to wp-admin/admin-ajax.php or wp-admin/admin-post.php with action parameters tied to the ki-live-video-conferences plugin.
Unexpected changes to plugin-managed configuration, conference entries, or settings without a corresponding administrator login event.
Access log entries showing repeated requests to plugin endpoints from a single external IP address.

Detection Strategies

Inventory WordPress sites and identify installations running the ki-live-video-conferences plugin at version 5.5.15 or earlier.
Enable WordPress audit logging to capture changes to plugin settings and correlate them with authenticated sessions.
Deploy web application firewall rules that block requests to plugin action handlers when the requester is unauthenticated.

Monitoring Recommendations

Monitor HTTP access logs for anomalous request patterns targeting plugin-specific action names.
Alert on WordPress option or post modifications that occur outside authenticated admin sessions.
Track outbound requests originating from the WordPress host that may indicate follow-on activity after abuse of plugin functionality.

How to Mitigate CVE-2025-23971

Immediate Actions Required

Update ki-live-video-conferences to a fixed release once whassan publishes a version above 5.5.15.
If no fixed version is available, deactivate and remove the plugin from all affected WordPress sites.
Restrict access to /wp-admin/admin-ajax.php and /wp-admin/admin-post.php from untrusted networks where feasible.

Patch Information

At the time of publication, the Patchstack Vulnerability Report lists the affected range as up to and including 5.5.15. Administrators should consult the vendor listing on the WordPress.org plugin directory for a patched release and apply it during the next maintenance window.

Workarounds

Disable the ki-live-video-conferences plugin until a patched version is available.
Add WAF rules that require authenticated sessions and valid nonces for requests targeting plugin action handlers.
Apply IP allow-listing for /wp-admin/ paths to limit exposure of vulnerable endpoints.

bash

# Example WAF rule (ModSecurity) blocking unauthenticated access to plugin actions
SecRule REQUEST_URI "@rx /wp-admin/admin-(ajax|post)\.php" \
  "chain,deny,status:403,id:1002397,msg:'Block unauth ki-live-video-conferences action'"
  SecRule ARGS:action "@rx ^ki[_-]live[_-]video" \
    "chain"
    SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"