CVE-2025-28997 Overview
CVE-2025-28997 is a Missing Authorization vulnerability [CWE-862] in the EXEIdeas International WP AutoKeyword plugin for WordPress. The flaw affects all versions of wp-autokeyword up to and including 1.0. The plugin exposes functionality protected by incorrectly configured access control security levels, allowing unauthenticated remote actors to reach features that should be restricted to privileged users. The vulnerability is remotely exploitable over the network without user interaction or authentication.
Critical Impact
Unauthenticated attackers can invoke plugin functions guarded by broken access controls, resulting in limited integrity impact on affected WordPress installations running WP AutoKeyword.
Affected Products
- EXEIdeas International WP AutoKeyword (wp-autokeyword) plugin for WordPress
- All versions from n/a through 1.0 (inclusive)
- WordPress sites with the vulnerable plugin installed and active
Discovery Timeline
- 2025-06-06 - CVE-2025-28997 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-28997
Vulnerability Analysis
The vulnerability is a Broken Access Control weakness classified under [CWE-862] Missing Authorization. The WP AutoKeyword plugin registers one or more actions or endpoints without verifying that the caller holds the required capability or nonce. As a result, restricted functionality can be triggered by any network-based requester, including unauthenticated visitors. Exploitation requires no privileges and no user interaction.
The impact is scoped to limited integrity effects. Confidentiality and availability are not directly affected according to the published CVSS vector. Because WordPress plugins commonly expose admin-ajax.php handlers and REST routes, this class of flaw typically permits attackers to invoke plugin actions such as modifying configuration or triggering keyword-related operations that were intended for administrators.
Root Cause
The root cause is the absence of a proper authorization check inside the plugin's action handlers. WordPress requires developers to call current_user_can() and validate a nonce with check_ajax_referer() or wp_verify_nonce() inside every privileged handler. In WP AutoKeyword <= 1.0, these checks are either missing or improperly implemented, allowing the handler to run regardless of the caller's role.
Attack Vector
An attacker sends a crafted HTTP request directly to the vulnerable plugin endpoint on a target WordPress site. Because no authentication or capability check gates the handler, the request executes with the intended privileged logic path. See the PatchStack WordPress Vulnerability advisory for reference details. No public proof-of-concept exploit is currently listed, and the vulnerability is not present on the CISA KEV list.
Detection Methods for CVE-2025-28997
Indicators of Compromise
- Unauthenticated HTTP POST or GET requests to admin-ajax.php with action parameters associated with the WP AutoKeyword plugin.
- Requests to plugin paths under /wp-content/plugins/wp-autokeyword/ originating from unknown IP addresses.
- Unexpected modifications to WP AutoKeyword plugin settings or keyword data without a corresponding administrator login event.
Detection Strategies
- Inventory WordPress installations and flag any site running wp-autokeyword version 1.0 or earlier.
- Review web server access logs for requests to plugin endpoints that lack a valid authenticated session cookie.
- Correlate plugin configuration changes with WordPress user session activity to detect actions performed without a logged-in administrator.
Monitoring Recommendations
- Enable verbose logging on admin-ajax.php and REST API routes and forward events to a centralized SIEM.
- Alert on repeated unauthenticated requests to WordPress AJAX actions from a single source, which indicate enumeration or exploitation attempts.
- Monitor file integrity and database changes on WordPress hosts to catch unauthorized modifications to plugin state.
How to Mitigate CVE-2025-28997
Immediate Actions Required
- Identify all WordPress sites running the wp-autokeyword plugin at version 1.0 or earlier.
- Deactivate and remove the plugin until a patched version is confirmed available from the vendor.
- Restrict access to /wp-admin/ and admin-ajax.php at the web server or WAF layer to reduce exposure of vulnerable handlers.
Patch Information
At the time of publication, no fixed version of WP AutoKeyword is referenced in the NVD entry. The advisory lists affected versions as n/a through <= 1.0 without a resolved release. Administrators should consult the PatchStack advisory for updated remediation guidance and monitor the plugin's official distribution channel for a security release.
Workarounds
- Uninstall the WP AutoKeyword plugin and replace it with a maintained alternative that enforces capability and nonce checks.
- Deploy a Web Application Firewall rule to block unauthenticated requests to plugin-specific action parameters served by admin-ajax.php.
- Enforce strong authentication on all WordPress administrator accounts and disable public registration where not required.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
