Refine your search
4 vulnerabilities found for Cryptocurrency (Token), Launchpad (Presale), ICO & IDO, Airdrop by TokenICO by beycanpress
CVE-2025-11773 (GCVE-0-2025-11773)
Vulnerability from nvd
Published
2025-11-21 07:31
Modified
2025-11-21 14:56
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-862 - Missing Authorization
Summary
The Cryptocurrency (Token), Launchpad (Presale), ICO & IDO, Airdrop by TokenICO plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'saveDeployedContract' function in all versions up to, and including, 2.4.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the WordPress option `tokenico_deployed_contracts`, poisoning the smart contract addresses displayed.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| beycanpress | Cryptocurrency (Token), Launchpad (Presale), ICO & IDO, Airdrop by TokenICO |
Version: * ≤ 2.4.6 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-11773",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-11-21T14:47:58.804349Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-11-21T14:56:17.486Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Cryptocurrency (Token), Launchpad (Presale), ICO \u0026 IDO, Airdrop by TokenICO",
"vendor": "beycanpress",
"versions": [
{
"lessThanOrEqual": "2.4.6",
"status": "affected",
"version": "*",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jonas Benjamin Friedli"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Cryptocurrency (Token), Launchpad (Presale), ICO \u0026 IDO, Airdrop by TokenICO plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the \u0027saveDeployedContract\u0027 function in all versions up to, and including, 2.4.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the WordPress option `tokenico_deployed_contracts`, poisoning the smart contract addresses displayed."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-11-21T07:31:57.590Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e02597b1-eea6-4fdd-baeb-527201d1c61f?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/tokenico-cryptocurrency-token-launchpad-presale-ico-ido-airdrop/tags/2.4.6/app/RestAPI.php#L108"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-11-20T19:19:51.000+00:00",
"value": "Disclosed"
}
],
"title": "Cryptocurrency (Token), Launchpad (Presale), ICO \u0026 IDO, Airdrop by TokenICO \u003c= 2.4.6 - Missing Authorization to Authenticated (Subscriber+) Contract Address Update"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2025-11773",
"datePublished": "2025-11-21T07:31:57.590Z",
"dateReserved": "2025-10-14T23:38:10.444Z",
"dateUpdated": "2025-11-21T14:56:17.486Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-11771 (GCVE-0-2025-11771)
Vulnerability from nvd
Published
2025-11-21 07:31
Modified
2025-11-21 14:56
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-306 - Missing Authentication for Critical Function
Summary
The Cryptocurrency (Token), Launchpad (Presale), ICO & IDO, Airdrop by TokenICO plugin for WordPress is vulnerable to unauthenticated and unauthorized modification of data due to missing authentication and capability checks on the 'createSaleRecord' function in all versions up to, and including, 2.4.6. This makes it possible for unauthenticated attackers to manipulate presales counters.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| beycanpress | Cryptocurrency (Token), Launchpad (Presale), ICO & IDO, Airdrop by TokenICO |
Version: * ≤ 2.4.6 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-11771",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-11-21T14:44:08.300071Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-11-21T14:56:45.347Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Cryptocurrency (Token), Launchpad (Presale), ICO \u0026 IDO, Airdrop by TokenICO",
"vendor": "beycanpress",
"versions": [
{
"lessThanOrEqual": "2.4.6",
"status": "affected",
"version": "*",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jonas Benjamin Friedli"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Cryptocurrency (Token), Launchpad (Presale), ICO \u0026 IDO, Airdrop by TokenICO plugin for WordPress is vulnerable to unauthenticated and unauthorized modification of data due to missing authentication and capability checks on the \u0027createSaleRecord\u0027 function in all versions up to, and including, 2.4.6. This makes it possible for unauthenticated attackers to manipulate presales counters."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-11-21T07:31:55.521Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c5c5793f-4d98-4ec1-a9b6-6e7c3f8b6099?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/tokenico-cryptocurrency-token-launchpad-presale-ico-ido-airdrop/tags/2.4.6/app/RestAPI.php#L275"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-11-20T19:19:37.000+00:00",
"value": "Disclosed"
}
],
"title": "Cryptocurrency (Token), Launchpad (Presale), ICO \u0026 IDO, Airdrop by TokenICO \u003c= 2.4.6 - Missing Authentication to Unauthenticated Presale Update"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2025-11771",
"datePublished": "2025-11-21T07:31:55.521Z",
"dateReserved": "2025-10-14T23:33:33.261Z",
"dateUpdated": "2025-11-21T14:56:45.347Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-11773 (GCVE-0-2025-11773)
Vulnerability from cvelistv5
Published
2025-11-21 07:31
Modified
2025-11-21 14:56
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-862 - Missing Authorization
Summary
The Cryptocurrency (Token), Launchpad (Presale), ICO & IDO, Airdrop by TokenICO plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'saveDeployedContract' function in all versions up to, and including, 2.4.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the WordPress option `tokenico_deployed_contracts`, poisoning the smart contract addresses displayed.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| beycanpress | Cryptocurrency (Token), Launchpad (Presale), ICO & IDO, Airdrop by TokenICO |
Version: * ≤ 2.4.6 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-11773",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-11-21T14:47:58.804349Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-11-21T14:56:17.486Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Cryptocurrency (Token), Launchpad (Presale), ICO \u0026 IDO, Airdrop by TokenICO",
"vendor": "beycanpress",
"versions": [
{
"lessThanOrEqual": "2.4.6",
"status": "affected",
"version": "*",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jonas Benjamin Friedli"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Cryptocurrency (Token), Launchpad (Presale), ICO \u0026 IDO, Airdrop by TokenICO plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the \u0027saveDeployedContract\u0027 function in all versions up to, and including, 2.4.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the WordPress option `tokenico_deployed_contracts`, poisoning the smart contract addresses displayed."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-11-21T07:31:57.590Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e02597b1-eea6-4fdd-baeb-527201d1c61f?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/tokenico-cryptocurrency-token-launchpad-presale-ico-ido-airdrop/tags/2.4.6/app/RestAPI.php#L108"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-11-20T19:19:51.000+00:00",
"value": "Disclosed"
}
],
"title": "Cryptocurrency (Token), Launchpad (Presale), ICO \u0026 IDO, Airdrop by TokenICO \u003c= 2.4.6 - Missing Authorization to Authenticated (Subscriber+) Contract Address Update"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2025-11773",
"datePublished": "2025-11-21T07:31:57.590Z",
"dateReserved": "2025-10-14T23:38:10.444Z",
"dateUpdated": "2025-11-21T14:56:17.486Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-11771 (GCVE-0-2025-11771)
Vulnerability from cvelistv5
Published
2025-11-21 07:31
Modified
2025-11-21 14:56
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-306 - Missing Authentication for Critical Function
Summary
The Cryptocurrency (Token), Launchpad (Presale), ICO & IDO, Airdrop by TokenICO plugin for WordPress is vulnerable to unauthenticated and unauthorized modification of data due to missing authentication and capability checks on the 'createSaleRecord' function in all versions up to, and including, 2.4.6. This makes it possible for unauthenticated attackers to manipulate presales counters.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| beycanpress | Cryptocurrency (Token), Launchpad (Presale), ICO & IDO, Airdrop by TokenICO |
Version: * ≤ 2.4.6 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-11771",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-11-21T14:44:08.300071Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-11-21T14:56:45.347Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Cryptocurrency (Token), Launchpad (Presale), ICO \u0026 IDO, Airdrop by TokenICO",
"vendor": "beycanpress",
"versions": [
{
"lessThanOrEqual": "2.4.6",
"status": "affected",
"version": "*",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jonas Benjamin Friedli"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Cryptocurrency (Token), Launchpad (Presale), ICO \u0026 IDO, Airdrop by TokenICO plugin for WordPress is vulnerable to unauthenticated and unauthorized modification of data due to missing authentication and capability checks on the \u0027createSaleRecord\u0027 function in all versions up to, and including, 2.4.6. This makes it possible for unauthenticated attackers to manipulate presales counters."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-11-21T07:31:55.521Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c5c5793f-4d98-4ec1-a9b6-6e7c3f8b6099?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/tokenico-cryptocurrency-token-launchpad-presale-ico-ido-airdrop/tags/2.4.6/app/RestAPI.php#L275"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-11-20T19:19:37.000+00:00",
"value": "Disclosed"
}
],
"title": "Cryptocurrency (Token), Launchpad (Presale), ICO \u0026 IDO, Airdrop by TokenICO \u003c= 2.4.6 - Missing Authentication to Unauthenticated Presale Update"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2025-11771",
"datePublished": "2025-11-21T07:31:55.521Z",
"dateReserved": "2025-10-14T23:33:33.261Z",
"dateUpdated": "2025-11-21T14:56:45.347Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}