CVE-2025-1440: Advanced iFrame <= 2024.5 - Unauthenticated Settings Update
First published: Wed Mar 26 2025(Updated: )
The Advanced iFrame plugin for WordPress is vulnerable to unauthorized excessive creation of options on the aip_map_url_callback() function in all versions up to, and including, 2024.5 due to insufficient restrictions. This makes it possible for unauthenticated attackers to update the advancediFrameParameterData option with an excessive amount of unvalidated data.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Advanced iFrame | <=2024.5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-1440?
CVE-2025-1440 is classified as a high-severity vulnerability due to its potential for unauthorized access and manipulation.
How do I fix CVE-2025-1440?
To fix CVE-2025-1440, update the Advanced iFrame plugin to the latest version beyond 2024.5.
Which versions of the Advanced iFrame plugin are affected by CVE-2025-1440?
CVE-2025-1440 affects all versions of the Advanced iFrame plugin up to and including version 2024.5.
Who can exploit the vulnerability identified in CVE-2025-1440?
CVE-2025-1440 can be exploited by unauthenticated attackers due to insufficient restrictions in the aip_map_url_callback() function.
What causes the vulnerability CVE-2025-1440?
The vulnerability CVE-2025-1440 is caused by insufficient restrictions that allow excessive creation of options in the Advanced iFrame plugin.
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- agent/title
- agent/references
- agent/author
- agent/source
- agent/weakness
- agent/severity
- agent/last-modified-date
- agent/type
- agent/description
- agent/first-publish-date
- agent/event
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- vendor/advanced iframe
- canonical/advanced iframe