CVE-2025-4302

MEDIUM NUCLEI

Stop User Enumeration <1.7.3 - Auth Bypass

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2025-4302. PoCs published by halilkirazkaya. A Nuclei detection template is also available.

AI-analyzed exploit summary This repository contains functional exploit code for multiple CVEs, including remote file inclusion, path traversal, and unauthorized file deletion vulnerabilities. The PoCs are well-structured and include HTTP requests to demonstrate the vulnerabilities.

Description

The Stop User Enumeration WordPress plugin before version 1.7.3 blocks REST API /wp-json/wp/v2/users/ requests for non-authorized users. However, this can be bypassed by URL-encoding the API path.

Exploits (1)

github WORKING POC 4 stars
by halilkirazkaya · poc
https://github.com/halilkirazkaya/cve-poc-garage/tree/main/2025/CVE-2025-4302.md

This repository contains functional exploit code for multiple CVEs, including remote file inclusion, path traversal, and unauthorized file deletion vulnerabilities. The PoCs are well-structured and include HTTP requests to demonstrate the vulnerabilities.

Classification
Working Poc 95%
Attack Type
Other
Complexity
Trivial
Reliability
Reliable
Target: Various (WordPress plugins, QNAP Photo Station, IBM Data Risk Manager, etc.)
No auth needed
Prerequisites: Network access to the target system
devstral-2 · analyzed Feb 27, 2026 Full analysis →

Nuclei Templates (1)

Stop User Enumeration WordPress plugin - Authentication Bypass
MEDIUMVERIFIEDby Kazgangap
Shodan: http.html:"/wp-content/plugins/stop-user-enumeration/"
FOFA: body=/wp-content/plugins/stop-user-enumeration/

References (1)

Core 1
Core References
Third Party Advisory, Exploit exploit vdb-entry technical-description
https://wpscan.com/vulnerability/19f67d6e-4ffe-4126-ac42-fb23c5017a3e

Scores

CVSS v3 5.3
EPSS 0.0148
EPSS Percentile 81.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact partial

Details

Status published
Products (1)
fullworksplugins/stop_user_enumeration < 1.7.3
Published Jul 17, 2025
Tracked Since Feb 18, 2026