What is CVE-2025-11986?

CVE-2025-11986 is a medium-severity vulnerability in Odude Crypto Tool, classified under Missing Authentication for Critical Function. CVSS score: 5.3/10. Published 2025-11-11.

How severe is CVE-2025-11986?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Is CVE-2025-11986 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Auth bypass in Odude Crypto Tool

CVE-2025-11986

The Crypto plugin for WordPress is vulnerable to Information exposure in all versions up to, and including, 2.22. This is due to the plugin registering an unauthenticated AJAX action (wp_ajax_nopriv_crypto_connect_ajax_process) that allows…

Vulnerability class: Broken Authentication

EPSS: 0.002 (43.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.

Affected products

Odude Crypto Tool — versions 0

Weakness classification (CWE)

CWE-306 — Missing Authentication for Critical Function

Public proof-of-concept exploits

jFriedli/CVE-2025-11986

References

Frequently asked questions

What is CVE-2025-11986?: CVE-2025-11986 is a medium-severity vulnerability in Odude Crypto Tool, classified under Missing Authentication for Critical Function. CVSS score: 5.3/10. Published 2025-11-11.
How severe is CVE-2025-11986?: Medium severity. CVSS v3 base score is 5.3 out of 10.
Is CVE-2025-11986 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.