CVE-2025-5701

The HyperComments plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the hc_request_handler function in all versions up to, and including, 1.2.2. This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.

• CWE-862

• https://plugins.trac.wordpress.org/browser/hypercomments/trunk/hypercomments.php
• https://www.wordfence.com/threat-intel/vulnerabilities/id/07fd6bee-5b00-4fc1-9f7a-3857fd35c763?source=cve

Published

Jun 5, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-5695A vulnerability has been found in Teledyne FLIR AX8 up to 1.…4.7
• CVE-2025-5696A vulnerability classified as critical was found in Brillian…9.8
• CVE-2025-5697A vulnerability, which was classified as critical, has been …9.8
• CVE-2025-5698A vulnerability, which was classified as critical, was found…9.8
• CVE-2025-5699The Developer Formatter plugin for WordPress is vulnerable t…5.5
• CVE-2025-5700The Simple Logo Carousel plugin for WordPress is vulnerable …6.4
• CVE-2025-5702The strcmp implementation optimized for the Power10 processo…5.6
• CVE-2025-5703The StageShow plugin for WordPress is vulnerable to Stored C…5.4
• CVE-2025-5704A vulnerability was found in code-projects Real Estate Prope…7.3
• CVE-2025-5705A vulnerability was found in code-projects Real Estate Prope…7.3
• CVE-2025-57052cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via t…9.8
• CVE-2025-57055WonderCMS 3.5.0 is vulnerable to Server-Side Request Forgery…6.5