{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-57923", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2025-08-22T11:36:12.721Z", "datePublished": "2025-09-22T18:25:10.891Z", "dateUpdated": "2025-10-24T15:14:25.559Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "uk-address-postcode-validation", "product": "UK Address Postcode Validation", "vendor": "Ideal Postcodes", "versions": [{"changes": [{"at": "3.10.0", "status": "unaffected"}], "lessThanOrEqual": "3.9.2", "status": "affected", "version": "n/a", "versionType": "custom"}]}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ideal_postcodes:uk_address_postcode_validation:*:*:*:*:*:*:*:*", "versionEndIncluding": "3.9.2", "versionStartIncluding": "n/a", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "OR"}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Nabil Irawan (Patchstack Bug Bounty Program)"}, {"lang": "en", "type": "remediation developer", "value": "Christopher Blanchard"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "An Insertion of Sensitive Information into Sent Data vulnerability in the Ideal Postcodes UK Address Postcode Validation WordPress plugin exposes the API key, allowing unauthorized third parties to retrieve and reuse the key across any domain. Since API keys are unrestricted by default, with the \u201cAllowed URLs\u201d field left empty upon creation of API key this can lead to unauthorized use and depletion of API credits.Note: the vulnerability is assessed based on the default configuration.<p>This issue affects UK Address Postcode Validation: from n/a through 3.9.2.</p>"}], "value": "An Insertion of Sensitive Information into Sent Data vulnerability in the Ideal Postcodes UK Address Postcode Validation WordPress plugin exposes the API key, allowing unauthorized third parties to retrieve and reuse the key across any domain. Since API keys are unrestricted by default, with the \u201cAllowed URLs\u201d field left empty upon creation of API key this can lead to unauthorized use and depletion of API credits.Note: the vulnerability is assessed based on the default configuration.This issue affects UK Address Postcode Validation: from n/a through 3.9.2."}], "impacts": [{"capecId": "CAPEC-37", "descriptions": [{"lang": "en", "value": "CAPEC-37 Retrieve Embedded Sensitive Data"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-201", "description": "CWE-201 Insertion of Sensitive Information Into Sent Data", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2025-10-24T15:14:25.559Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/wordpress/plugin/uk-address-postcode-validation/vulnerability/wordpress-uk-address-postcode-validation-plugin-3-9-2-sensitive-data-exposure-vulnerability?_s_id=cve"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Update to&nbsp;3.10.0 or a higher version.<br><br>The vendor has implemented measures to notify users about potential API misuse when the API key is not restricted to requests from defined domain names or IP addresses. The exposure of the API key is now considered logic by design. Users are informed about the associated risks, and additional safeguards will be introduced on the API key creation and management page.<br>"}], "value": "Update to\u00a03.10.0 or a higher version.\n\nThe vendor has implemented measures to notify users about potential API misuse when the API key is not restricted to requests from defined domain names or IP addresses. The exposure of the API key is now considered logic by design. Users are informed about the associated risks, and additional safeguards will be introduced on the API key creation and management page."}], "source": {"discovery": "EXTERNAL"}, "tags": ["x_open-source"], "timeline": [{"lang": "en", "time": "2025-08-19T03:24:00.000Z", "value": "Vendor was notified about the vulnerability."}, {"lang": "en", "time": "2025-09-22T03:26:00.000Z", "value": "Database entry and CVE published (no patched version, no reply from the vendor)"}, {"lang": "en", "time": "2025-09-29T03:29:00.000Z", "value": "Vendor contacted back to ask for additional details"}, {"lang": "en", "time": "2025-10-03T03:33:00.000Z", "value": "Vendor claims there's no issue, refuses to patch (hide API key from public access)"}, {"lang": "en", "time": "2025-10-24T15:09:00.000Z", "value": "Patch released"}], "title": "WordPress UK Address Postcode Validation Plugin <= 3.9.2 - Sensitive Data Exposure Vulnerability", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-23T14:11:11.995861Z", "id": "CVE-2025-57923", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-23T14:12:13.789Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-57923", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-23T14:11:11.995861Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-23T14:12:08.704Z"}}], "cna": {"tags": ["x_open-source"], "title": "WordPress UK Address Postcode Validation Plugin <= 3.9.2 - Sensitive Data Exposure Vulnerability", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Nabil Irawan (Patchstack Bug Bounty Program)"}, {"lang": "en", "type": "remediation developer", "value": "Christopher Blanchard"}], "impacts": [{"capecId": "CAPEC-37", "descriptions": [{"lang": "en", "value": "CAPEC-37 Retrieve Embedded Sensitive Data"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Ideal Postcodes", "product": "UK Address Postcode Validation", "versions": [{"status": "affected", "changes": [{"at": "3.10.0", "status": "unaffected"}], "version": "n/a", "versionType": "custom", "lessThanOrEqual": "3.9.2"}], "packageName": "uk-address-postcode-validation", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-08-19T03:24:00.000Z", "value": "Vendor was notified about the vulnerability."}, {"lang": "en", "time": "2025-09-22T03:26:00.000Z", "value": "Database entry and CVE published (no patched version, no reply from the vendor)"}, {"lang": "en", "time": "2025-09-29T03:29:00.000Z", "value": "Vendor contacted back to ask for additional details"}, {"lang": "en", "time": "2025-10-03T03:33:00.000Z", "value": "Vendor claims there's no issue, refuses to patch (hide API key from public access)"}, {"lang": "en", "time": "2025-10-24T15:09:00.000Z", "value": "Patch released"}], "solutions": [{"lang": "en", "value": "Update to\u00a03.10.0 or a higher version.\n\nThe vendor has implemented measures to notify users about potential API misuse when the API key is not restricted to requests from defined domain names or IP addresses. The exposure of the API key is now considered logic by design. Users are informed about the associated risks, and additional safeguards will be introduced on the API key creation and management page.", "supportingMedia": [{"type": "text/html", "value": "Update to&nbsp;3.10.0 or a higher version.<br><br>The vendor has implemented measures to notify users about potential API misuse when the API key is not restricted to requests from defined domain names or IP addresses. The exposure of the API key is now considered logic by design. Users are informed about the associated risks, and additional safeguards will be introduced on the API key creation and management page.<br>", "base64": false}]}], "references": [{"url": "https://patchstack.com/database/wordpress/plugin/uk-address-postcode-validation/vulnerability/wordpress-uk-address-postcode-validation-plugin-3-9-2-sensitive-data-exposure-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "An Insertion of Sensitive Information into Sent Data vulnerability in the Ideal Postcodes UK Address Postcode Validation WordPress plugin exposes the API key, allowing unauthorized third parties to retrieve and reuse the key across any domain. Since API keys are unrestricted by default, with the \u201cAllowed URLs\u201d field left empty upon creation of API key this can lead to unauthorized use and depletion of API credits.Note: the vulnerability is assessed based on the default configuration.This issue affects UK Address Postcode Validation: from n/a through 3.9.2.", "supportingMedia": [{"type": "text/html", "value": "An Insertion of Sensitive Information into Sent Data vulnerability in the Ideal Postcodes UK Address Postcode Validation WordPress plugin exposes the API key, allowing unauthorized third parties to retrieve and reuse the key across any domain. Since API keys are unrestricted by default, with the \u201cAllowed URLs\u201d field left empty upon creation of API key this can lead to unauthorized use and depletion of API credits.Note: the vulnerability is assessed based on the default configuration.<p>This issue affects UK Address Postcode Validation: from n/a through 3.9.2.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-201", "description": "CWE-201 Insertion of Sensitive Information Into Sent Data"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ideal_postcodes:uk_address_postcode_validation:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "3.9.2", "versionStartIncluding": "n/a"}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2025-10-24T15:14:25.559Z"}}}, "cveMetadata": {"cveId": "CVE-2025-57923", "state": "PUBLISHED", "dateUpdated": "2025-10-24T15:14:25.559Z", "dateReserved": "2025-08-22T11:36:12.721Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2025-09-22T18:25:10.891Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "An Insertion of Sensitive Information into Sent Data vulnerability in the Ideal Postcodes UK Address Postcode Validation WordPress plugin exposes the API key, allowing unauthorized third parties to retrieve and reuse the key across any domain. Since API keys are unrestricted by default, with the \u201cAllowed URLs\u201d field left empty upon creation of API key this can lead to unauthorized use and depletion of API credits.Note: the vulnerability is assessed based on the default configuration.This issue affects UK Address Postcode Validation: from n/a through 3.9.2."}], "id": "CVE-2025-57923", "lastModified": "2025-10-24T16:17:13.520", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "audit@patchstack.com", "type": "Secondary"}]}, "published": "2025-09-22T19:15:49.183", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/wordpress/plugin/uk-address-postcode-validation/vulnerability/wordpress-uk-address-postcode-validation-plugin-3-9-2-sensitive-data-exposure-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-201"}], "source": "audit@patchstack.com", "type": "Secondary"}]}

{}