CVE-2025-11986

CVE-2025-11986 affects the WordPress Crypto Tool plugin (

CVE-2025-11986: Missing Authentication for Critical Function

The Crypto plugin for WordPress is vulnerable to Information exposure in all versions up to, and including, 2.22. This is due to the plugin registering an unauthenticated AJAX action wpajaxnoprivcryptoconnectajaxprocess that allows calling the register and savenft methods with only a...