CVE-2025-49041

Vulnerability

Description The Get Cash plugin for WordPress versions up to and including 3.2.3 suffers from a missing authorization vulnerability. This allows an attacker to exploit incorrectly configured access control security levels, meaning that functions that should require authentication or higher privileges can be accessed without proper checks.

Exploitation

An attacker can exploit this vulnerability without needing any prior authentication or special privileges. By sending crafted requests to the vulnerable endpoints, they can trigger actions that should be restricted. This type of broken access control is commonly targeted in mass-exploit campaigns against WordPress sites.

Impact

Successful exploitation could allow an attacker to perform unauthorized actions, potentially leading to privilege escalation, data modification, or other malicious activities depending on the affected functionality.

Mitigation

The vulnerability has been addressed in a subsequent update. Users are advised to update the Get Cash plugin to the latest version available. If unable to update, users should consider additional security measures such as web application firewalls or consult their hosting provider for assistance [1].