CVE-2025-4654

Soumettre.fr <= 2.1.5 - Improper Authorization to Unauthenticated Soumettre Posts Creation/Modification/Deletion

Published Jul 2, 2025 CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Description

The Soumettre.fr plugin for WordPress is vulnerable to unauthorized access and modification of data due to a improper authorization checks on the make_signature function in all versions up to, and including, 2.1.5. This makes it possible for unauthenticated attackers to create/edit/delete Soumettre posts. This vulnerability affects only installations where the soumettre account is not connected (i.e. API key is not installed)

Analysis

Technical impact

The Soumettre.fr plugin for WordPress contains an improper authorization check in its make_signature function, allowing an attacker to create, edit, or delete Soumettre posts without authentication. This access control failure (CWE-285) results in unauthorized manipulation of content, potentially compromising the integrity of the site and exposing sensitive information.

Affected Systems

WordPress installations running Soumettre.fr version 2.1.5 or earlier, specifically when the Soumettre account is not connected via an API key.

Risk and Exploitability

The vulnerability has a CVSS score of 3.7, indicating low severity. Its EPSS score is below 1%, suggesting a very low probability of exploitation in the wild. It is not listed in the CISA KEV catalog. The attack vector is inferred to be unauthenticated access via the plugin’s REST API endpoints, where the lack of proper authorization allows attackers to perform post actions.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

soumettre

Soumettre.fr

unaffected

Version	Status	Constraints
`0`	affected	≤ 2.1.5

No data.

Vendor	Product	Versions
Wordpress	Wordpress	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update Soumettre.fr to the latest available version where the authorization check has been fixed
If an update cannot be applied immediately, remove or disable the plugin, or disable API key connectivity to prevent unauthorized operations
Audit the WordPress REST API configuration to ensure that all endpoints for Soumettre posts require proper authentication before allowing creation, editing, or deletion

Generated by OpenCVE AI on April 21, 2026 at 19:56 UTC.

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2025-19681	The Soumettre.fr plugin for WordPress is vulnerable to unauthorized access and modification of data due to a improper authorization checks on the make_signature function in all versions up to, and including, 2.1.5. This makes it possible for unauthenticated attackers to create/edit/delete Soumettre posts. This vulnerability affects only installations where the soumettre account is not connected (i.e. API key is not installed)

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.258% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://plugins.trac.wordpress.org/browser/soumettre-fr/tags/2.1.5/public/rest/class-soumettre-rest-route.php#L211
https://www.wordfence.com/threat-intel/vulnerabilities/id/4f29d476-0730-437c-8065-309523278efa?source=cve

History

Jul 2, 2025 2:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jul 2, 2025 4:00 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The Soumettre.fr plugin for WordPress is vulnerable to unauthorized access and modification of data due to a improper authorization checks on the make_signature function in all versions up to, and including, 2.1.5. This makes it possible for unauthenticated attackers to create/edit/delete Soumettre posts. This vulnerability affects only installations where the soumettre account is not connected (i.e. API key is not installed)
Title		Soumettre.fr <= 2.1.5 - Improper Authorization to Unauthenticated Soumettre Posts Creation/Modification/Deletion
Weaknesses		CWE-285
References		https://plugins.trac.wordpress.org/browser/soumettre-fr/tags/2.1.5/public/rest/class-soumettre-rest-route.php#L211 https://www.wordfence.com/threat-intel/vulnerabilities/id/4f29d476-0730-437c-8065-309523278efa?source=cve
Metrics		cvssV3_1 `{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N'}`