CVE-2025-3776

Published Apr 24, 2025

Last updated 6 days ago

Overview

AI description

Generated using AI and has not been reviewed by Intruder. May contain errors.

CVE-2025-3776 is a vulnerability found in the Verification SMS with TargetSMS plugin for WordPress, affecting versions up to and including 1.5. The vulnerability allows for limited Remote Code Execution (RCE) due to a lack of validation on the type of function that can be called via the 'targetvr_ajax_handler' function. This flaw stems from the use of `call_user_func()` on user-controlled input without proper sanitization against a whitelist of allowed functions. As a result, unauthenticated attackers can execute arbitrary PHP functions that exist in memory, potentially leading to the execution of commands like phpinfo() or other malicious functions if an attacker can load them.

Description: The Verification SMS with TargetSMS plugin for WordPress is vulnerable to limited Remote Code Execution in all versions up to, and including, 1.5 via the 'targetvr_ajax_handler' function. This is due to a lack of validation on the type of function that can be called. This makes it possible for unauthenticated attackers to execute any callable function on the site, such as phpinfo().
Source: security@wordfence.com
NVD status: Awaiting Analysis

Risk scores

CVSS 3.1

Type: Primary
Base score: 8.3
Impact score: 3.7
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
Severity: HIGH

Weaknesses

security@wordfence.com: CWE-94

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 53

Overview

AI description

Risk scores

CVSS 3.1

Weaknesses

Social media

References