CVE-2025-39580: Dashi Authorization Bypass Vulnerability

CVE-2025-39580 Overview

CVE-2025-39580 is a missing authorization vulnerability in the jidaikobo Dashi plugin for WordPress. The flaw allows unauthenticated attackers to access functionality that is not properly constrained by access control lists (ACLs). The issue affects all versions of Dashi up to and including 3.1.8.

The vulnerability is tracked under CWE-862: Missing Authorization. It is exploitable over the network without user interaction or authentication. The scope is changed, meaning successful exploitation can affect resources beyond the vulnerable component itself.

Critical Impact
Unauthenticated attackers can invoke plugin functionality reserved for privileged users, leading to unauthorized information disclosure on affected WordPress sites.

Affected Products

jidaikobo Dashi WordPress plugin, all versions through 3.1.8
WordPress installations with the Dashi plugin activated
Sites relying on Dashi for dashboard or administrative widgets

Discovery Timeline

2025-04-17 - CVE-2025-39580 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-39580

Vulnerability Analysis

The Dashi plugin fails to enforce authorization checks on one or more of its exposed actions. Requests reach sensitive functionality without validating whether the caller has the required capability or role. This is a classic broken access control pattern common in WordPress plugins that register AJAX handlers or REST endpoints without capability checks.

The vulnerability enables an unauthenticated remote attacker to interact with plugin functions from any network location. The confidentiality impact is low, while integrity and availability are not affected. Because the scope is changed, actions performed through the plugin may impact data or components governed by a different security authority than the plugin itself.

The EPSS probability indicates a low likelihood of exploitation activity in the near term, but the network-accessible, unauthenticated nature of the flaw makes internet-facing WordPress sites the primary risk surface.

Root Cause

The root cause is missing authorization enforcement inside Dashi request handlers. WordPress plugins are expected to call current_user_can() or verify nonces before executing privileged operations. Dashi omits these checks on at least one code path, allowing anonymous callers to trigger functionality intended for logged-in administrators or editors.

Attack Vector

An attacker sends a crafted HTTP request to a WordPress site running Dashi 3.1.8 or earlier. The request targets the vulnerable plugin endpoint directly. Because the handler does not check user capabilities, the plugin executes the requested action and returns data the caller should not be able to obtain.

The vulnerability is described in the Patchstack advisory for the Dashi broken access control issue. No public proof-of-concept exploit or exploit database entry is currently listed for CVE-2025-39580.

Detection Methods for CVE-2025-39580

Indicators of Compromise

Unauthenticated HTTP requests to Dashi plugin endpoints under /wp-admin/admin-ajax.php or /wp-json/ referencing the dashi action or route.
HTTP 200 responses to anonymous requests that return plugin data normally reserved for logged-in users.
Repeated probing from a single IP against wp-content/plugins/dashi/ paths.

Detection Strategies

Inventory WordPress installations and identify sites running the Dashi plugin at version 3.1.8 or earlier.
Review web server access logs for unauthenticated requests to Dashi AJAX or REST endpoints without a valid session cookie.
Deploy a web application firewall rule that flags requests to Dashi actions lacking a wp-nonce header or authenticated session.

Monitoring Recommendations

Enable verbose logging on WordPress and forward logs to a centralized analytics platform for anomaly review.
Alert on spikes in admin-ajax.php traffic originating from external, unauthenticated sources.
Track plugin file integrity to detect modifications following suspected exploitation attempts.

How to Mitigate CVE-2025-39580

Immediate Actions Required

Identify all WordPress sites running the Dashi plugin and confirm the installed version.
Deactivate the Dashi plugin on any site running version 3.1.8 or earlier until a patched release is applied.
Restrict access to /wp-admin/ and /wp-json/ endpoints at the network edge where feasible.

Patch Information

At the time of publication, the vendor advisory lists Dashi versions through 3.1.8 as vulnerable. Administrators should consult the Patchstack advisory for Dashi and the WordPress plugin repository for the latest fixed version and apply it immediately once available.

Workarounds

Remove or deactivate the Dashi plugin until a patched version is installed.
Deploy a virtual patch through a WordPress-aware WAF that blocks anonymous requests to Dashi endpoints.
Enforce IP allowlisting on wp-admin for administrative users to reduce the attack surface.

bash

# Deactivate the Dashi plugin using WP-CLI
wp plugin deactivate dashi

# Verify the plugin status
wp plugin status dashi