CVE-2025-26975: Strong Testimonials Auth Bypass Flaw

CVE-2025-26975 Overview

CVE-2025-26975 is a Missing Authorization vulnerability [CWE-862] in the WP Chill Strong Testimonials plugin for WordPress. The flaw affects all versions of strong-testimonials up to and including 3.2.3. Attackers can access plugin functionality that is not properly constrained by access control lists (ACLs). The vulnerability is remotely exploitable over the network without authentication or user interaction. Successful exploitation leads to limited integrity impact on the affected WordPress site.

Critical Impact
Unauthenticated remote attackers can invoke plugin functionality intended to be restricted, resulting in low-integrity impact against WordPress sites running Strong Testimonials 3.2.3 or earlier.

Affected Products

WP Chill Strong Testimonials plugin for WordPress
Versions from n/a through <= 3.2.3
WordPress sites with the strong-testimonials plugin installed and active

Discovery Timeline

2025-02-25 - CVE-2025-26975 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-26975

Vulnerability Analysis

The vulnerability stems from missing authorization checks within the Strong Testimonials plugin. The plugin exposes functionality that should be restricted to privileged users but fails to enforce capability or role validation before executing sensitive operations. WordPress plugins typically enforce access control through current_user_can() capability checks and nonce verification via check_ajax_referer() or wp_verify_nonce(). The absence of these checks in vulnerable endpoints allows any unauthenticated visitor to invoke restricted functionality. The exploitation vector is network-based with low attack complexity, and no privileges or user interaction are required. The impact is limited to integrity, meaning attackers can modify data or state controlled by the exposed functions without affecting confidentiality or availability.

Root Cause

The root cause is classified as [CWE-862] Missing Authorization. The plugin registers handlers, such as AJAX actions or REST routes, that execute privileged operations without validating whether the requesting user holds the appropriate capability. Broken access control leaves the underlying operations reachable by any anonymous HTTP request.

Attack Vector

An attacker sends a crafted HTTP request to a vulnerable endpoint exposed by the plugin, such as an admin-ajax.php action or a REST API route registered by strong-testimonials. Because authorization is not enforced, the server executes the action with the effective permissions expected of an administrator or editor. Refer to the Patchstack Vulnerability Report for the technical details of the affected endpoints.

Detection Methods for CVE-2025-26975

Indicators of Compromise

Unauthenticated POST requests to /wp-admin/admin-ajax.php referencing Strong Testimonials actions from external IP addresses
Requests to plugin REST routes under /wp-json/ associated with strong-testimonials originating from unauthenticated sessions
Unexpected creation or modification of testimonial content, plugin settings, or related post metadata without a corresponding administrator login event

Detection Strategies

Review WordPress access logs for anomalous request patterns targeting strong-testimonials AJAX or REST endpoints without an authenticated session cookie
Enable WordPress debug logging and audit plugin action calls, correlating them with authenticated user sessions
Monitor plugin configuration and testimonial database tables for unauthorized changes to identify post-exploitation activity

Monitoring Recommendations

Deploy a Web Application Firewall (WAF) with virtual patching rules for Strong Testimonials versions 3.2.3 and earlier
Alert on HTTP 200 responses to unauthenticated requests targeting plugin administrative actions
Track plugin inventory across WordPress fleets to identify hosts still running vulnerable versions of strong-testimonials

How to Mitigate CVE-2025-26975

Immediate Actions Required

Update the Strong Testimonials plugin to a version later than 3.2.3 as soon as the vendor publishes a fix
If no fixed version is available, deactivate and remove the strong-testimonials plugin from affected WordPress installations
Audit testimonial content, plugin settings, and site configuration for unauthorized modifications

Patch Information

Strong Testimonials versions up to and including 3.2.3 are affected. Consult the Patchstack Vulnerability Report for the current patch status and upgrade guidance from WP Chill.

Workarounds

Restrict access to /wp-admin/admin-ajax.php and plugin REST routes at the WAF or reverse proxy layer for unauthenticated clients
Apply Patchstack or equivalent virtual patching to block exploit requests targeting the vulnerable plugin actions
Enforce the principle of least privilege for WordPress user accounts and rotate credentials if compromise is suspected

bash

# Example: block unauthenticated access to Strong Testimonials AJAX actions at the reverse proxy
# nginx configuration snippet
location = /wp-admin/admin-ajax.php {
    if ($arg_action ~* "^(wpmtst_|strong_testimonials_)") {
        return 403;
    }
}