CVE-2025-53295: iCount Gateway Auth Bypass Vulnerability

CVE-2025-53295 Overview

CVE-2025-53295 is a Missing Authorization vulnerability [CWE-862] in the iCount Payment Gateway plugin for WordPress. The flaw affects all plugin versions up to and including 2.0.7. Attackers can access functionality that is not properly constrained by access control lists (ACLs) over the network without authentication or user interaction. The vulnerability enables limited integrity impact on affected WordPress sites that use the iCount payment integration.

Critical Impact
Unauthenticated attackers can invoke plugin functionality that should be restricted by ACLs, leading to unauthorized modifications within the iCount Payment Gateway integration.

Affected Products

iCount Payment Gateway plugin for WordPress
All versions from n/a through 2.0.7
WordPress sites with the icount plugin installed and active

Discovery Timeline

2025-06-27 - CVE-2025-53295 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-53295

Vulnerability Analysis

The iCount Payment Gateway plugin fails to enforce authorization checks on one or more of its exposed actions or endpoints. The plugin registers functionality that should be limited to authenticated administrators or authorized roles. However, the plugin does not validate the caller's capability or verify a valid nonce before executing sensitive operations. Attackers reach the vulnerable code paths through standard WordPress request handlers such as admin-ajax.php or REST routes.

The issue falls under Broken Access Control, mapped to [CWE-862] Missing Authorization. The EPSS score is 0.257% as of 2026-07-14, indicating low but non-zero exploitation probability.

Root Cause

The root cause is the absence of current_user_can() capability checks and missing check_admin_referer() or wp_verify_nonce() validation on plugin handlers. WordPress plugins must gate privileged actions behind explicit role checks. The iCount plugin exposes callback functions that execute without confirming the requester's authorization level.

Attack Vector

An attacker sends crafted HTTP requests to the vulnerable WordPress endpoint exposed by the iCount plugin. No credentials, tokens, or user interaction are required. The request triggers the unprotected action handler, which performs the restricted operation against the payment gateway configuration or related data. Because the attack vector is network-based with low complexity, automated scanners can identify and exploit vulnerable sites at scale.

No public proof-of-concept exploit has been published. Technical details are documented in the Patchstack Vulnerability Report.

Detection Methods for CVE-2025-53295

Indicators of Compromise

Unexpected POST requests to wp-admin/admin-ajax.php referencing iCount plugin actions from unauthenticated sessions.
Unauthorized changes to iCount plugin settings, API keys, or payment configuration in the WordPress database.
Anomalous entries in WordPress access logs targeting /wp-content/plugins/icount/ paths.

Detection Strategies

Review web server access logs for repeated requests to iCount plugin endpoints without authenticated session cookies.
Monitor WordPress option tables for unauthorized modifications to icount_* configuration entries.
Deploy web application firewall (WAF) rules that flag requests to plugin AJAX actions from unauthenticated sources.

Monitoring Recommendations

Enable WordPress activity logging to capture plugin configuration changes with user attribution.
Alert on outbound requests from the WordPress host to unexpected iCount API destinations.
Track plugin version inventory across WordPress deployments to identify vulnerable installations of icount <= 2.0.7.

How to Mitigate CVE-2025-53295

Immediate Actions Required

Update the iCount Payment Gateway plugin to a version newer than 2.0.7 once the vendor releases a patched release.
Audit WordPress user accounts and iCount configuration for unauthorized modifications made prior to patching.
Rotate any API credentials or secrets associated with the iCount payment integration.

Patch Information

The Patchstack advisory tracks fix status for this vulnerability. Administrators should consult the Patchstack Vulnerability Report for the current fixed version and apply it through the WordPress plugin manager or via WP-CLI.

Workarounds

Deactivate the iCount Payment Gateway plugin until a patched version is installed if payment processing is not business-critical.
Restrict access to wp-admin/admin-ajax.php and the plugin directory through a WAF or reverse proxy rules that require authenticated sessions.
Apply virtual patching rules through a managed WAF to block requests matching the vulnerable plugin action parameters.

bash

# Example WP-CLI command to identify vulnerable installations
wp plugin get icount --field=version
wp plugin deactivate icount