CVE-2025-15485

The Auto x LINE WordPress plugin through version 1.0.0 does not enforce authorization checks (CWE-862) on some of its REST API endpoints, leaving them callable by unauthenticated users. An attacker triggers the flaw simply by sending network requests to the affected wp-json REST routes, with no credentials, privileges, or user interaction required. Successful abuse lets the attacker update plugin settings, clear logs, and take whatever other actions those endpoints allow; the high confidentiality component of the 8.2 CVSS score suggests at least one affected endpoint may also expose information. Any WordPress site with the plugin installed at version 1.0.0 or earlier is affected. There is no known public proof-of-concept, the issue is not in CISA's KEV, and EPSS puts the 30-day exploitation probability at 0.2%, so exploitation is not currently known to be occurring.

What to do: Inventory WordPress sites for the Auto x LINE plugin; since no patched version is documented, deactivate or remove the plugin, or block unauthenticated access to its REST routes (e.g., via WAF rules), until an official fix is released. Review web server and WordPress logs for unauthenticated calls to the site's /wp-json/ REST API that modified plugin settings or cleared logs, and monitor the WPScan/plugin listing for a fixed version.