CVE-2025-11191

MediumCVSS 5.3

Published: 31/10/2025(UTC)Updated: 07/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.31%

22th percentile - higher than 22% of all known CVEs

Summary

The RealPress WordPress plugin before version 1.1.0 registers REST routes without proper permission checks, allowing the creation of pages and sending of emails from the site.

Risk Assessment

The risk includes unauthorized creation of pages and sending of emails, potentially leading to abuse and compromise of site integrity.

Recommendation

It is recommended to upgrade the plugin to version 1.1.0 or later and implement proper permission checks for REST routes.

Other vulnerabilities in RealPress

CVE-2026-66458Critical
The RealPress plugin versions up to 1.1.2 contain an unauthenticated SQL Injection vulnerability. An attacker without logging in can send specially crafted queries that can manipulate the database.

Original NVD description (English source)

The RealPress WordPress plugin before 1.1.0 registers the REST routes without proper permission checks, allowing the creation of pages and sending of emails from the site.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS