PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-15485 Auto x LINE CVE debrief

The Auto x LINE WordPress plugin through 1.0.0 does not have authorization checks in some of its REST endpoints, allowing unauthenticated users to call them and update the plugin settings, clear logs etc. This vulnerability allows unauthenticated access and modification of plugin settings and logs, potentially leading to unauthorized access and disruption of plugin functionality. Defenders should assess exposure, prioritize remediation, and verify plugin versions. The vulnerability has a CVSS score of 8.2 and is considered HIGH severity.

Vendor
Auto x LINE
Product
Auto x LINE WordPress plugin
CVSS
HIGH 8.2
CISA KEV
Not listed in stored evidence
Original CVE published
2026-09-02
Original CVE updated
2026-09-03
Advisory published
2026-09-02
Advisory updated
2026-09-03

Who should care

WordPress administrators, security teams, and IT professionals responsible for maintaining and securing WordPress installations with the Auto x LINE plugin should assess exposure and prioritize remediation.

Why it matters

Defenders should care about CVE-2025-15485 because it allows unauthenticated users to access and modify Auto x LINE WordPress plugin settings and logs, potentially leading to unauthorized access and disruption of plugin functionality. WordPress administrators and security teams should assess exposure, prioritize remediation, and verify plugin versions.

  • Potential unauthorized access to plugin settings and logs
  • Possible disruption of plugin functionality
  • Required verification of plugin version and remediation

Technical summary

The Auto x LINE WordPress plugin through 1.0.0 does not have authorization checks in some of its REST endpoints, allowing unauthenticated users to call them and update the plugin settings, clear logs etc. This vulnerability has a CVSS score of 8.2 and is considered HIGH severity.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability in their WordPress installations, especially those with exposed or internet-facing Auto x LINE plugin deployments.

Recommended defensive actions

  • Verify the Auto x LINE WordPress plugin version and ensure it is updated or patched
  • Review and restrict access to the plugin's REST endpoints
  • Monitor plugin logs and settings for suspicious activity

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in the Auto x LINE WordPress plugin. WPScan vulnerability page references the Auto x LINE WordPress plugin and describes the vulnerability.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-15485 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-15485

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-15485 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-15485

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.