CVE-2025-5288 Missing authorization in REST API | Custom API Generator For Cross Platform And Import Export In WP
Unauthenticated attackers can escalate privileges to Administrator by exploiting a missing capability check in the import handler.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-5288?
CVE-2025-5288 is a critical missing authorization vulnerability in weboccults REST API | Custom API Generator For Cross Platform And Import Export In WP, published on 13 Jun 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The REST API | Custom API Generator For Cross Platform And Import Export In WP plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the process_handler() function in versions 1.0.0 to 2.0.3. This makes it possible for unauthenticated attackers to POST an arbitrary import_api URL, import specially crafted JSON, and thereby create a new user with full Administrator privileges.
Weakness: CWE-862
Which versions are affected by CVE-2025-5288?
How do I fix CVE-2025-5288?
No fix has been published for CVE-2025-5288 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-5288 being exploited?
There is no known exploitation of CVE-2025-5288 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-hqr5-32x6-7hw9.