CVE-2025-5288

🗓️ 13 Jun 2025 01:47:46Reported by WordfenceType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 97 Views🌐 WEB

Vulnerability in Custom API Generator allows unauthenticated privilege escalation in WordPress plugin.

Reporter	Title	Published	Views	Family All 12
GithubExploit	Exploit for CVE-2025-5288	12 Jun 202519:59	–	githubexploit
Circl	CVE-2025-5288	13 Jun 202502:34	–	circl
CNNVD	WordPress plugin REST API \| Custom API Generator For Cross Platform And Import Export In WP 安全漏洞	13 Jun 202500:00	–	cnnvd
Cvelist	CVE-2025-5288 REST API \| Custom API Generator For Cross Platform And Import Export In WP 1.0.0 - 2.0.3 - Missing Authorization to Unauthenticated Privilege Escalation via process_handler Function	13 Jun 202501:47	–	cvelist
EUVD	EUVD-2025-18240	3 Oct 202520:07	–	euvd
NVD	CVE-2025-5288	13 Jun 202503:15	–	nvd
Packet Storm News	Custom API Generator for Cross Platform and Import Export in WP 2.0.3 Privilege Escalation	13 Jun 202500:00	–	packetstormnews
Patchstack	WordPress REST API \| Custom API Generator For Cross Platform And Import Export In WP plugin <= 2.0.3 - Missing Authorization to Unauthenticated Privilege Escalation via process_handler Function vulnerability	13 Jun 202506:41	–	patchstack
Positive Technologies	PT-2025-25367 · WordPress · Rest Api \| Custom Api Generator For Cross Platform/Import Export In Wp	12 Jun 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-5288	15 Jun 202502:16	–	redhatcve

Vulners

Node

weboccults rest_api_|_custom_api_generator_for_cross_platform_and_import_export_in_wpRange1.0.0–2.0.3wordpress

[
  {
    "vendor": "weboccults",
    "product": "REST API | Custom API Generator For Cross Platform And Import Export In WP",
    "versions": [
      {
        "version": "1.0.0",
        "status": "affected",
        "lessThanOrEqual": "2.0.3",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/import-export-with-custom-rest-api/tags/2.0.3/backend/methods/wot-rapi-import-functions.php
wordpress	www.wordpress.org/plugins/import-export-with-custom-rest-api/
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/0e2774fc-f028-436c-a8af-3c17378b9743

Parameter	Position	Path	Description	CWE
author_data	request body	/wordpress/	Unauthenticated privilege escalation via missing capability check allows creating an Administrator by posting crafted JSON to the vulnerable plugin endpoint.	CWE-862
title	request body	/wordpress/	Unauthenticated privilege escalation via missing capability check allows creating an Administrator by posting crafted JSON to the vulnerable plugin endpoint.	CWE-862
content	request body	/wordpress/	Unauthenticated privilege escalation via missing capability check allows creating an Administrator by posting crafted JSON to the vulnerable plugin endpoint.	CWE-862

17 Jun 2026 09:47Current

9.4High risk

Vulners AI Score9.4

CVSS 3.19.8

EPSS0.00532

SSVC

CWE-862