Technical impact
The vulnerability lies in the missing capability check on the 'saveDeployedContract' function within the TokenICO WordPress plugin. It allows any authenticated user with Subscriber level access or higher to overwrite the WordPress option that stores deployed smart‑contract addresses. This results in an integrity breach where attackers can replace legitimate contract addresses with malicious ones, potentially steering users or transactions to attacker‑controlled contracts. The weakness corresponds to a missing authorization check (CWE-862).
Affected Systems
WordPress sites running the Cryptocurrency (Token), Launchpad (Presale), ICO & IDO, Airdrop by TokenICO plugin version 2.4.7 or earlier are impacted. The vulnerability affects all users who can authenticate and possess at least Subscriber role privileges.
Risk and Exploitability
The CVSS score of 4.3 indicates moderate severity, largely because exploitation requires authenticated access. The EPSS score of less than 1% suggests that the likelihood of real‑world exploitation at the present time is low. The vulnerability is not listed in the CISA KEV catalog, further reducing the probability that it is actively exploited. The attack vector is inferred to be web‑based, facilitated by the plugin's REST API endpoint that lacks proper authorization checks, allowing authenticated actors to modify stored contract data.
