{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-57923", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2025-08-22T11:36:12.721Z", "datePublished": "2025-09-22T18:25:10.891Z", "dateUpdated": "2025-10-24T03:53:30.326Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "uk-address-postcode-validation", "product": "UK Address Postcode Validation", "vendor": "Ideal Postcodes", "versions": [{"lessThanOrEqual": "3.9.2", "status": "affected", "version": "n/a", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Nabil Irawan (Patchstack Bug Bounty Program)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>An Insertion of Sensitive Information into Sent Data vulnerability in the Ideal Postcodes UK Address Postcode Validation WordPress plugin exposes the API key, allowing unauthorized third parties to retrieve and reuse the key across any domain. Since API keys are unrestricted by default, with the \u201cAllowed URLs\u201d field left empty upon creation of API key this can lead to unauthorized use and depletion of API credits.<br><br>Note: the vulnerability is assessed based on the default configuration.</p><p>This issue affects UK Address Postcode Validation: from n/a through 3.9.2.</p>"}], "value": "An Insertion of Sensitive Information into Sent Data vulnerability in the Ideal Postcodes UK Address Postcode Validation WordPress plugin exposes the API key, allowing unauthorized third parties to retrieve and reuse the key across any domain. Since API keys are unrestricted by default, with the \u201cAllowed URLs\u201d field left empty upon creation of API key this can lead to unauthorized use and depletion of API credits.\n\nNote: the vulnerability is assessed based on the default configuration.\n\nThis issue affects UK Address Postcode Validation: from n/a through 3.9.2."}], "impacts": [{"capecId": "CAPEC-37", "descriptions": [{"lang": "en", "value": "CAPEC-37 Retrieve Embedded Sensitive Data"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-201", "description": "CWE-201 Insertion of Sensitive Information Into Sent Data", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2025-10-24T03:53:30.326Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/wordpress/plugin/uk-address-postcode-validation/vulnerability/wordpress-uk-address-postcode-validation-plugin-3-9-2-sensitive-data-exposure-vulnerability?_s_id=cve"}, {"tags": ["related"], "url": "https://web.archive.org/web/20250807222539/https://docs.ideal-postcodes.co.uk/docs/guides/api-key-secure"}], "source": {"discovery": "EXTERNAL"}, "tags": ["x_open-source"], "timeline": [{"lang": "en", "time": "2025-08-19T03:24:00.000Z", "value": "Vendor was notified about the vulnerability."}, {"lang": "en", "time": "2025-09-22T03:26:00.000Z", "value": "Database entry and CVE published (no patched version, no reply from the vendor)"}, {"lang": "en", "time": "2025-09-29T03:29:00.000Z", "value": "Vendor contacted back to ask for additional details"}, {"lang": "en", "time": "2025-10-03T03:33:00.000Z", "value": "Vendor claims there's no issue, refuses to patch (hide API key from public access)"}], "title": "WordPress UK Address Postcode Validation Plugin <= 3.9.2 - Sensitive Data Exposure Vulnerability", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-23T14:11:11.995861Z", "id": "CVE-2025-57923", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-23T14:12:13.789Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-57923", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-23T14:11:11.995861Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-23T14:12:08.704Z"}}], "cna": {"tags": ["x_open-source"], "title": "WordPress UK Address Postcode Validation Plugin <= 3.9.2 - Sensitive Data Exposure Vulnerability", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Nabil Irawan (Patchstack Bug Bounty Program)"}], "impacts": [{"capecId": "CAPEC-37", "descriptions": [{"lang": "en", "value": "CAPEC-37 Retrieve Embedded Sensitive Data"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Ideal Postcodes", "product": "UK Address Postcode Validation", "versions": [{"status": "affected", "version": "n/a", "versionType": "custom", "lessThanOrEqual": "3.9.2"}], "packageName": "uk-address-postcode-validation", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-08-19T03:24:00.000Z", "value": "Vendor was notified about the vulnerability."}, {"lang": "en", "time": "2025-09-22T03:26:00.000Z", "value": "Database entry and CVE published (no patched version, no reply from the vendor)"}, {"lang": "en", "time": "2025-09-29T03:29:00.000Z", "value": "Vendor contacted back to ask for additional details"}, {"lang": "en", "time": "2025-10-03T03:33:00.000Z", "value": "Vendor claims there's no issue, refuses to patch (hide API key from public access)"}], "references": [{"url": "https://patchstack.com/database/wordpress/plugin/uk-address-postcode-validation/vulnerability/wordpress-uk-address-postcode-validation-plugin-3-9-2-sensitive-data-exposure-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}, {"url": "https://web.archive.org/web/20250807222539/https://docs.ideal-postcodes.co.uk/docs/guides/api-key-secure", "tags": ["related"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "An Insertion of Sensitive Information into Sent Data vulnerability in the Ideal Postcodes UK Address Postcode Validation WordPress plugin exposes the API key, allowing unauthorized third parties to retrieve and reuse the key across any domain. Since API keys are unrestricted by default, with the \u201cAllowed URLs\u201d field left empty upon creation of API key this can lead to unauthorized use and depletion of API credits.\n\nNote: the vulnerability is assessed based on the default configuration.\n\nThis issue affects UK Address Postcode Validation: from n/a through 3.9.2.", "supportingMedia": [{"type": "text/html", "value": "<p>An Insertion of Sensitive Information into Sent Data vulnerability in the Ideal Postcodes UK Address Postcode Validation WordPress plugin exposes the API key, allowing unauthorized third parties to retrieve and reuse the key across any domain. Since API keys are unrestricted by default, with the \u201cAllowed URLs\u201d field left empty upon creation of API key this can lead to unauthorized use and depletion of API credits.<br><br>Note: the vulnerability is assessed based on the default configuration.</p><p>This issue affects UK Address Postcode Validation: from n/a through 3.9.2.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-201", "description": "CWE-201 Insertion of Sensitive Information Into Sent Data"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2025-10-24T03:53:30.326Z"}}}, "cveMetadata": {"cveId": "CVE-2025-57923", "state": "PUBLISHED", "dateUpdated": "2025-10-24T03:53:30.326Z", "dateReserved": "2025-08-22T11:36:12.721Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2025-09-22T18:25:10.891Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "An Insertion of Sensitive Information into Sent Data vulnerability in the Ideal Postcodes UK Address Postcode Validation WordPress plugin exposes the API key, allowing unauthorized third parties to retrieve and reuse the key across any domain. Since API keys are unrestricted by default, with the \u201cAllowed URLs\u201d field left empty upon creation of API key this can lead to unauthorized use and depletion of API credits.\n\nNote: the vulnerability is assessed based on the default configuration.\n\nThis issue affects UK Address Postcode Validation: from n/a through 3.9.2."}], "id": "CVE-2025-57923", "lastModified": "2025-10-24T04:15:54.060", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "audit@patchstack.com", "type": "Secondary"}]}, "published": "2025-09-22T19:15:49.183", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/wordpress/plugin/uk-address-postcode-validation/vulnerability/wordpress-uk-address-postcode-validation-plugin-3-9-2-sensitive-data-exposure-vulnerability?_s_id=cve"}, {"source": "audit@patchstack.com", "url": "https://web.archive.org/web/20250807222539/https://docs.ideal-postcodes.co.uk/docs/guides/api-key-secure"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-201"}], "source": "audit@patchstack.com", "type": "Secondary"}]}

{}

{"created": "2025-09-23T16:05:08.026899+00:00", "updated": "2025-09-23T16:05:08.026995+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}