CVE-2025-8425
📋 TL;DR
The My WP Translate WordPress plugin has a privilege escalation vulnerability that allows authenticated users with Subscriber-level access or higher to modify WordPress site options. Attackers can change the default registration role to administrator and enable user registration, gaining full administrative control. All WordPress sites using My WP Translate version 1.1 or earlier are affected.
💻 Affected Systems
- My WP Translate WordPress Plugin
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Complete site takeover where attackers gain administrative access, install backdoors, steal data, deface the site, or use it for further attacks.
Likely Case
Attackers create administrator accounts and gain persistent access to vulnerable WordPress sites.
If Mitigated
With proper access controls and monitoring, unauthorized privilege escalation attempts are detected and blocked before damage occurs.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward via crafted AJAX requests to the vulnerable function.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version after 1.1
Vendor Advisory: https://plugins.trac.wordpress.org/browser/my-wp-translate
Restart Required: No
Instructions:
1. Update My WP Translate plugin to latest version via WordPress admin panel. 2. If update not available, disable and remove the plugin immediately. 3. Verify no unauthorized administrator accounts exist.
🔧 Temporary Workarounds
Disable My WP Translate Plugin
allTemporarily disable the vulnerable plugin until patched version is available
wp plugin deactivate my-wp-translate
Restrict User Registration
allDisable user registration in WordPress settings to prevent attacker account creation
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block requests to ajax_import_strings function
- Monitor for unauthorized administrator account creation and WordPress option changes
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > My WP Translate version. If version is 1.1 or earlier, site is vulnerable.Check Version:
wp plugin list --name=my-wp-translate --field=versionVerify Fix Applied:
Verify My WP Translate plugin version is greater than 1.1 and test that ajax_import_strings function requires proper capabilities.📡 Detection & Monitoring
Log Indicators:
- POST requests to /wp-admin/admin-ajax.php with action=import_strings
- Unauthorized administrator account creation
- Changes to WordPress options (particularly default_role and users_can_register)
Network Indicators:
- Unusual AJAX requests from authenticated users to admin-ajax.php endpoint
SIEM Query:
source="wordpress.log" AND ("action=import_strings" OR "default_role=administrator" OR "users_can_register=1")