CVE-2025-11771

MEDIUM

TokenICO plugin <2.4.6 - Info Disclosure

Title source: llm
STIX 2.1

Description

The Cryptocurrency (Token), Launchpad (Presale), ICO & IDO, Airdrop by TokenICO plugin for WordPress is vulnerable to unauthenticated and unauthorized modification of data due to missing authentication and capability checks on the 'createSaleRecord' function in all versions up to, and including, 2.4.7. This makes it possible for unauthenticated attackers to manipulate presales counters.

Exploits (1)

nomisec WORKING POC
by jFriedli · poc
https://github.com/jFriedli/CVE-2025-11771

References (3)

Core 3

Scores

CVSS v3 5.3
EPSS 0.0027
EPSS Percentile 50.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-306
Status published
Products (2)
beycanpress/Cryptocurrency (Token), Launchpad (Presale), ICO & IDO, Airdrop by TokenICO < 2.4.6
beycanpress/Cryptocurrency (Token), Launchpad (Presale), ICO & IDO, Airdrop by TokenICO < 2.4.7
Published Nov 21, 2025
Tracked Since Feb 18, 2026