CVE-2025-0954 WP Online Contract <= 5.1.4 - Missing Authorization to Unauthenticated Settings Import

The WP Online Contract plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the jsonimport and jsonexport functions in all versions up to, and including, 5.1.4. This makes it possible for unauthenticated attackers to import and export the plugin's setting...

CVE-2025-0954 WP Online Contract <= 5.1.4 - Missing Authorization to Unauthenticated Settings Import

The WP Online Contract plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the jsonimport and jsonexport functions in all versions up to, and including, 5.1.4. This makes it possible for unauthenticated attackers to import and export the plugin's setting...

CVE-2025-0954

CVE-2025-0954 affects the WordPress plugin “WP Online Contract”. The vulnerability is a missing capability check in json_import() and json_export() across all versions up to 5.1.4, allowing unauthenticated attackers to import/export the plugin’s settings. Public sources in the provided documents ...