CVE-2025-6720: Vchasno Kasa Auth Bypass Vulnerability

CVE-2025-6720 Overview

CVE-2025-6720 is a missing authorization vulnerability in the Vchasno Kasa plugin for WordPress. The flaw affects all versions up to and including 1.0.3. The clear_all_log() function lacks a capability check, allowing unauthenticated attackers to clear plugin log files over the network. The issue is categorized under CWE-862: Missing Authorization.

Critical Impact
Unauthenticated attackers can remotely delete plugin log data, resulting in loss of audit records and hindering post-incident investigation of the affected WordPress site.

Affected Products

Vchasno Kasa plugin for WordPress, all versions through 1.0.3
WordPress sites running the mrkv-vchasno-kasa plugin
Environments exposing the plugin's AJAX or admin endpoints to unauthenticated users

Discovery Timeline

2025-07-19 - CVE-2025-6720 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-6720

Vulnerability Analysis

The Vchasno Kasa plugin exposes a clear_all_log() function within its setup class. This function is reachable through the plugin's request handler but does not verify the caller's capabilities or authentication state. Any remote user can invoke it and remove the plugin's log entries.

The attack requires no privileges and no user interaction. The impact is limited to integrity of stored log data. Confidentiality and availability of the wider WordPress installation are not directly affected. However, destroying log evidence can mask prior malicious activity and complicate forensic response.

The EPSS probability for this issue is 0.358%, reflecting a low near-term exploitation forecast relative to the broader CVE population.

Root Cause

The root cause is the absence of a current_user_can() capability check and a missing WordPress nonce validation on the clear_all_log() handler in classes/mrkv-setup.php. The function trusts the incoming request and performs a destructive action on plugin log data without verifying the requester's identity or intent.

Attack Vector

An unauthenticated attacker sends a crafted HTTP request to the WordPress site targeting the plugin action that maps to clear_all_log(). The server processes the request, invokes the log-clearing routine, and truncates or deletes the plugin's log files. The attacker needs only network reachability to the WordPress front end.

Code-level details of the vulnerable handler are available in the WordPress Plugin Class Code and the corresponding fix in the WordPress Changeset Details. Additional analysis is available in the Wordfence Vulnerability Analysis.

Detection Methods for CVE-2025-6720

Indicators of Compromise

Unexpected truncation or emptying of Vchasno Kasa plugin log files under the plugin's data directory.
HTTP requests to admin-ajax.php or plugin endpoints referencing clear_all_log from unauthenticated sessions.
Access log entries showing POST or GET requests to plugin actions from IPs with no prior authenticated session cookies.

Detection Strategies

Inventory WordPress installations and identify sites running mrkv-vchasno-kasa at version 1.0.3 or earlier.
Alert on web server access logs containing the plugin action name combined with a missing or invalid WordPress auth cookie.
Compare current plugin log file sizes and timestamps against a known-good baseline to identify unauthorized clearing.

Monitoring Recommendations

Forward WordPress access logs and PHP error logs to a centralized log platform for correlation and retention.
Monitor for spikes in requests to plugin AJAX endpoints from single source IPs or automated scanners.
Configure file integrity monitoring on the plugin's log directory to detect unauthorized modification or deletion.

How to Mitigate CVE-2025-6720

Immediate Actions Required

Update the Vchasno Kasa plugin to a version later than 1.0.3 where the capability check on clear_all_log() has been added.
If no fixed version is deployable, deactivate and remove the plugin until a patched release is installed.
Review plugin log files and site access logs for evidence of prior unauthorized invocation of the log-clear action.

Patch Information

The vendor addressed the issue in the plugin repository. Review the WordPress Changeset Details to confirm the fix adds an authorization check before executing clear_all_log(). Apply the update through the WordPress plugin manager or WP-CLI.

Workarounds

Restrict access to wp-admin/admin-ajax.php plugin actions using a Web Application Firewall (WAF) rule that requires an authenticated session cookie.
Block requests containing the clear_all_log action parameter at the reverse proxy or WAF layer until the plugin is patched.
Enforce IP allow-listing on the WordPress admin surface where operationally feasible.

bash

# Update the Vchasno Kasa plugin using WP-CLI
wp plugin update mrkv-vchasno-kasa

# Verify installed version is greater than 1.0.3
wp plugin get mrkv-vchasno-kasa --field=version