CVE-2025-52775 Overview
CVE-2025-52775 is a missing authorization vulnerability in the Project Cost Calculator WordPress plugin developed by Ronik@UnlimitedWP. The flaw affects all versions of the plugin up to and including 1.0.0. Authenticated attackers with low privileges can exploit incorrectly configured access control checks to perform unauthorized actions within the plugin. The issue is tracked under CWE-862: Missing Authorization and is documented in the Patchstack Vulnerability Report.
Critical Impact
Authenticated users with minimal privileges can bypass access control checks, modify plugin data, and trigger high availability impact on affected WordPress sites.
Affected Products
- Ronik@UnlimitedWP Project Cost Calculator plugin for WordPress
- All plugin versions from initial release through 1.0.0
- WordPress sites with the project-cost-calculator plugin installed and active
Discovery Timeline
- 2025-08-14 - CVE-2025-52775 published to NVD
- 2026-04-23 - Last updated in NVD database
Technical Details for CVE-2025-52775
Vulnerability Analysis
The Project Cost Calculator plugin fails to enforce proper authorization checks on one or more of its action handlers. WordPress plugins typically expose functionality through admin-ajax.php, REST API endpoints, or admin-post handlers. Each of these entry points must verify both authentication and capability before executing privileged operations.
In this plugin, the access control logic is incorrectly configured, allowing requests from authenticated users who lack the intended administrative role. The vulnerability requires only low-privilege access, meaning any Subscriber-level account is sufficient to reach affected functionality. The flaw produces no confidentiality impact but allows integrity changes and high availability degradation on the target site.
Root Cause
The root cause is a missing or insufficient capability check, classified as [CWE-862]. Vulnerable handlers either omit current_user_can() validation entirely or rely on a capability that is granted to low-privilege roles. Nonce verification alone, without capability enforcement, does not constrain who may invoke the action.
Attack Vector
The attack vector is network-based and requires an authenticated session on the target WordPress site. An attacker registers or compromises a Subscriber-level account, then sends crafted HTTP requests to the plugin's exposed endpoints. Because the handler executes without verifying the caller's role, the attacker can trigger plugin operations reserved for administrators, alter calculator data, or disrupt site availability.
No verified proof-of-concept code is publicly available. Refer to the Patchstack Vulnerability Report for additional technical context.
Detection Methods for CVE-2025-52775
Indicators of Compromise
- Requests to /wp-admin/admin-ajax.php referencing project-cost-calculator actions originating from non-administrative user sessions.
- Unexpected changes to plugin configuration, calculator entries, or stored options created or modified by Subscriber-level accounts.
- Spikes in 200-status responses to plugin endpoints from accounts that have never accessed the WordPress admin area.
Detection Strategies
- Review web server access logs for POST requests to plugin endpoints correlated with low-privilege wordpress_logged_in_* cookies.
- Enable WordPress audit logging to capture user role, action name, and HTTP referrer for every plugin AJAX call.
- Compare current plugin database options against a known-good baseline to detect unauthorized writes.
Monitoring Recommendations
- Alert on any modification of plugin-managed options performed by users below the Editor role.
- Monitor for newly registered Subscriber accounts immediately followed by requests to plugin endpoints.
- Track HTTP request rates per authenticated user to flag automated abuse of the vulnerable handler.
How to Mitigate CVE-2025-52775
Immediate Actions Required
- Deactivate and remove the Project Cost Calculator plugin until a patched version is released by the vendor.
- Audit existing WordPress accounts and remove unrecognized or dormant Subscriber-level users.
- Restrict new user registration on sites that do not require open signup by setting Anyone can register to disabled.
Patch Information
No fixed version is listed in the public advisory at the time of writing. The vulnerability affects all releases through 1.0.0. Monitor the Patchstack Vulnerability Report and the official plugin page for an updated release that introduces proper capability checks.
Workarounds
- Block public access to /wp-admin/admin-ajax.php actions associated with project-cost-calculator using a web application firewall rule.
- Use a WordPress security plugin to require an administrator capability for all plugin endpoints until a vendor patch is available.
- Disable open user registration and enforce strong authentication, including multi-factor authentication, for all accounts.
# Example: temporarily disable the vulnerable plugin via WP-CLI
wp plugin deactivate project-cost-calculator
wp plugin status project-cost-calculator
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
