CVE-2025-11771

MEDIUM

TokenICO plugin <2.4.6 - Info Disclosure

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2025-11771. PoCs published by jFriedli.

AI-analyzed exploit summary This repository contains a functional exploit PoC for CVE-2025-11771, demonstrating unauthenticated creation of sale records in a WordPress plugin via a REST API endpoint. The exploit uses both JavaScript (fetch) and curl to send crafted POST requests to the vulnerable endpoint.

Description

The Cryptocurrency (Token), Launchpad (Presale), ICO & IDO, Airdrop by TokenICO plugin for WordPress is vulnerable to unauthenticated and unauthorized modification of data due to missing authentication and capability checks on the 'createSaleRecord' function in all versions up to, and including, 2.4.7. This makes it possible for unauthenticated attackers to manipulate presales counters.

Exploits (1)

nomisec WORKING POC
by jFriedli · poc
https://github.com/jFriedli/CVE-2025-11771

This repository contains a functional exploit PoC for CVE-2025-11771, demonstrating unauthenticated creation of sale records in a WordPress plugin via a REST API endpoint. The exploit uses both JavaScript (fetch) and curl to send crafted POST requests to the vulnerable endpoint.

Classification
Working Poc 95%
Attack Type
Auth Bypass
Complexity
Trivial
Reliability
Reliable
Target: WordPress plugin (likely Tokenico or similar)
No auth needed
Prerequisites: Access to the WordPress REST API endpoint · Vulnerable plugin installed
devstral-2 · analyzed Apr 28, 2026 Full analysis →

References (3)

Core 3

Scores

CVSS v3 5.3
EPSS 0.0028
EPSS Percentile 19.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-306
Status published
Products (2)
beycanpress/Cryptocurrency (Token), Launchpad (Presale), ICO & IDO, Airdrop by TokenICO < 2.4.6
beycanpress/Cryptocurrency (Token), Launchpad (Presale), ICO & IDO, Airdrop by TokenICO < 2.4.7
Published Nov 21, 2025
Tracked Since Feb 18, 2026