CVE-2025-15485: Auto x LINE <= 1.0.0 – Unauthenticated REST API Endpoints Call
The Auto x LINE WordPress plugin through 1.0.0 does not have authorization checks in some of its REST endpoints, allowing unauthenticated users to call them and update the plugin settings, clear logs etc
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update the Auto x LINE WordPress plugin so that every exposed REST endpoint performs proper authorization and denies unauthenticated users from modifying plugin settings or clearing logs.
Auto x LINE WordPress plugin REST endpoint authorization checks = Add authorization checks to all REST endpoints (reject unauthenticated requests)
Event History
Frequently Asked Questions
Who can exploit the affected endpoints?
Unauthenticated users can call some affected REST API endpoints. No account or other privileges are required.
What could an attacker do through the exposed endpoints?
An attacker can update the plugin's settings and clear logs. The available data does not identify all affected endpoints or every possible action.
Which plugin versions are affected?
Auto x LINE versions through 1.0.0 are affected.