Medium severity6.5NVD Advisory· Published Mar 5, 2025· Updated Jun 17, 2026

CVE-2025-0954

Description

The WP Online Contract plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the json_import() and json_export() functions in all versions up to, and including, 5.1.4. This makes it possible for unauthenticated attackers to import and export the plugin's settings.

Affected products

WordPress/Wp Online Contractinferred2 versions
<=5.1.4+ 1 more
- (no CPE)range: <=5.1.4
- (no CPE)range: <=5.1.4
Package: https://wordpress.org/plugins/wp-online-contract

Patches

Vulnerability mechanics

References

codecanyon.net/item/wp-online-contract/7698011nvd
www.wordfence.com/threat-intel/vulnerabilities/id/70f464ca-ff6c-4c2e-8b56-bf5e4bc6bd1fnvd

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000