CVE-2025-2779: Insert Headers and Footers Code – HT Script <= 1.1.2 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update
First published: Wed Apr 02 2025(Updated: )
The Insert Headers and Footers Code – HT Script plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_dismiss function in all versions up to, and including, 1.1.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update option values to 1/true on the WordPress site. This can be leveraged to update an option that would create an error on the site and deny access to legitimate users or be used to set some values to true, such as registration.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| HT Insert Headers and Footers Code – HT Script | <=1.1.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-2779?
The severity of CVE-2025-2779 is considered medium due to potential unauthorized data modification by authenticated attackers.
How do I fix CVE-2025-2779?
To fix CVE-2025-2779, update the Insert Headers and Footers Code – HT Script plugin to version 1.1.3 or later.
Who is affected by CVE-2025-2779?
All users of the Insert Headers and Footers Code – HT Script plugin for WordPress versions up to and including 1.1.2 are affected by CVE-2025-2779.
What is the exploit mechanism for CVE-2025-2779?
CVE-2025-2779 can be exploited through the ajax_dismiss function, which does not have a proper capability check.
Are there any mitigation strategies for CVE-2025-2779?
A potential mitigation strategy for CVE-2025-2779 is to disable the plugin until it is updated to the patched version.
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/references
- agent/title
- agent/type
- agent/first-publish-date
- agent/description
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/author
- agent/source
- agent/last-modified-date
- agent/severity
- agent/tags
- agent/event
- vendor/ht
- canonical/ht insert headers and footers code – ht script