Executive Summary:
A critical vulnerability has been identified in the Hydra Booking plugin for WordPress, which allows any authenticated user, regardless of their permission level, to change the password of any other user on the site. This flaw can be exploited by a low-privileged attacker to gain full administrative control over the website, leading to a complete system compromise. The high severity of this vulnerability necessitates immediate action to prevent potential data theft, website defacement, or further attacks originating from the compromised system.

Vulnerability Details

CVE-ID: CVE-2025-7689

Affected Software: Hydra Booking plugin for WordPress

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability is a privilege escalation flaw within the tfhb_reset_password_callback() function of the Hydra Booking plugin. This function, designed to handle password resets, does not perform a capability check to verify that the user initiating the request has the appropriate permissions to modify other user accounts. As a result, any authenticated user (e.g., a subscriber) can send a crafted request to this function to reset the password for any user, including administrators, by simply knowing the target's username. Successful exploitation grants the attacker unauthorized access to the target account's privileges, which can lead to a full site takeover if an administrator account is compromised.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 8.8. Exploitation can lead to a complete compromise of the organization's WordPress website. An attacker with administrative access could steal sensitive company or customer data, deface the website causing significant reputational damage, inject malicious code to attack site visitors, or use the compromised server to launch further attacks. The potential business impact includes direct financial loss from business disruption, costs associated with incident response and cleanup, regulatory fines for data breaches, and a long-term loss of customer trust.

Remediation Plan

Immediate Action: Immediately update the Hydra Booking plugin to the latest version provided by the vendor, which contains the patch for this vulnerability. After updating, thoroughly review all user accounts, particularly those with administrative privileges, for any unauthorized password changes or suspicious activity. If the plugin is not critical to business operations, consider deactivating and removing it to reduce the overall attack surface.

Proactive Monitoring: Monitor web server and application logs for POST requests to the WordPress AJAX endpoint (/wp-admin/admin-ajax.php) that specifically call the tfhb_reset_password_callback action. Configure alerts for unexpected password changes or privilege escalations within the WordPress audit logs. Monitor for new administrative account creations and logins from unrecognized IP addresses or geolocations.

Compensating Controls: If patching cannot be performed immediately, implement a Web Application Firewall (WAF) with a virtual patching rule to block malicious requests targeting the vulnerable function. Enforce Multi-Factor Authentication (MFA) across all user accounts, especially for administrators, as this will prevent an attacker from logging in even if they successfully reset a password. Restrict access to the WordPress administrative dashboard (/wp-admin/) to only trusted IP addresses.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of July 29, 2025, there are no known public exploits or active exploitation campaigns targeting this vulnerability. However, the simplicity of exploiting this flaw (requiring only a low-privileged account) combined with its high impact makes it a prime target for future development of proof-of-concept (PoC) code. Threat actors specializing in WordPress attacks are likely to weaponize this vulnerability quickly once it becomes widely known.

Analyst Recommendation

Given the high severity (CVSS 8.8) of this vulnerability and the critical risk of a full website compromise, we recommend treating its remediation as a top priority. Organizations must apply the vendor-supplied patch for the Hydra Booking plugin immediately. Although CVE-2025-7689 is not currently on the CISA KEV list, its characteristics make it an extremely attractive target for attackers. Proactive patching is the most effective defense and is essential to prevent unauthorized access and protect the integrity of your web assets.

Executive Summary:
A critical vulnerability exists in the web server component of multiple Zyxel networking devices. This flaw allows an unauthenticated remote attacker to execute arbitrary code by sending a specially crafted web request, potentially leading to a complete compromise of the affected device. Due to the high severity and low attack complexity, this vulnerability poses a significant risk to network security and requires immediate attention.

Vulnerability Details

CVE-ID: CVE-2025-7673

Affected Software: The zhttpd web server in Zyxel firmware for multiple products, including the VMG8825-T50K.

Affected Versions: VMG8825-T50K firmware versions prior to V5.50(ABOM.5)C0. See vendor advisory for a complete list of other affected products and versions.

Vulnerability: The vulnerability is a buffer overflow within the URL parsing function of the zhttpd web server. An unauthenticated attacker can send a specially crafted HTTP request containing an overly long URL. This action overwrites the memory buffer allocated for the URL, allowing the attacker to corrupt adjacent memory, which can lead to a denial-of-service (DoS) condition or, more critically, enable remote code execution (RCE) with the privileges of the web server process.

Business Impact

This vulnerability is rated as critical severity with a CVSS score of 9.8. Successful exploitation would allow an attacker to gain complete control over the affected Zyxel device, which often serves as a network gateway. This could lead to severe consequences, including interception and redirection of network traffic, unauthorized access to the internal network, theft of sensitive data, and the use of the compromised device in a botnet for larger-scale attacks. The risk to business continuity, data confidentiality, and network integrity is exceptionally high.

Remediation Plan

Immediate Action: The primary remediation is to apply the security patches provided by the vendor. Administrators should immediately update the firmware on affected Zyxel devices to the latest available version (e.g., version V5.50(ABOM.5)C0 or later for the VMG8825-T50K). After patching, it is crucial to monitor for any signs of post-remediation exploitation attempts and review historical access logs for indicators of compromise.

Proactive Monitoring: Organizations should configure network monitoring tools and security information and event management (SIEM) systems to detect and alert on exploit attempts. Specifically, monitor web server logs for HTTP requests with unusually long or malformed URLs. Network Intrusion Detection/Prevention Systems (IDS/IPS) should be updated with signatures that can identify and block traffic matching the attack pattern for CVE-2025-7673.

Compensating Controls: If immediate patching is not feasible, restrict access to the device's web management interface to a trusted, isolated management network. If remote access is required, ensure it is protected behind a Virtual Private Network (VPN). A properly configured Web Application Firewall (WAF) or an IPS with virtual patching capabilities may also provide a layer of protection by blocking malicious requests before they reach the vulnerable service.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of the publication date of this advisory (Jul 16, 2025), there are no known public exploits or reports of active exploitation in the wild. However, due to the critical severity (CVSS 9.8) and the low complexity of the attack, it is highly probable that a functional proof-of-concept exploit will be developed and published by security researchers in the near future, increasing the likelihood of widespread attacks.

Analyst Recommendation
This is a critical, unauthenticated remote code execution vulnerability affecting perimeter network devices. Although it is not currently on the CISA KEV list, its severity and ease of exploitation make it an extremely attractive target for threat actors. We strongly recommend that organizations treat this as an emergency and apply the vendor-supplied firmware updates to all affected Zyxel devices immediately to prevent a potential network compromise.

Executive Summary:
A high-severity vulnerability has been identified in the JS Archive List plugin for WordPress, affecting all versions up to and including 6. This flaw allows an unauthenticated attacker to steal sensitive information from the website's database, such as user credentials, personal data, and site content, by sending specially crafted requests to the server. Due to the ease of exploitation and the potential for complete database compromise, immediate remediation is strongly advised.

Vulnerability Details

CVE-ID: CVE-2025-7670

Affected Software: WordPress JS Archive List plugin

Affected Versions: All versions up to, and including, 6

Vulnerability: The vulnerability is a time-based SQL Injection flaw within the build_sql_where() function of the JS Archive List plugin. The function fails to properly sanitize user-supplied input before using it to construct a SQL query. An unauthenticated attacker can craft a malicious SQL query that includes a time-delay command (e.g., SLEEP() or BENCHMARK()). By measuring the server's response time, the attacker can infer the results of the query one character at a time, allowing them to progressively exfiltrate data from the database without directly seeing the output.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 7.5. Successful exploitation could lead to a significant data breach, resulting in the unauthorized disclosure of sensitive information stored in the WordPress database. This includes user accounts, hashed passwords, customer data, and other confidential site information. The business risks include reputational damage, loss of customer trust, regulatory fines (if PII is compromised), and the potential for attackers to use stolen credentials to gain further access to the system or escalate privileges.

Remediation Plan

Immediate Action: The primary remediation is to update the JS Archive List plugin to the latest patched version provided by the developer. If the plugin is not essential for business operations, it should be deactivated and removed entirely to eliminate the risk.

Proactive Monitoring: Monitor web server and database logs for unusually long-running queries or requests targeting the plugin's functionality. Specifically, look for SQL commands like SLEEP() or BENCHMARK() in web request logs. Implement database activity monitoring to detect and alert on anomalous query patterns.

Compensating Controls: If immediate patching is not feasible, implement a Web Application Firewall (WAF) with rules specifically designed to detect and block SQL Injection attempts. Enforce the principle of least privilege for the WordPress database user account, ensuring it only has the minimum permissions necessary to operate the site.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of August 19, 2025, there are no reports of this vulnerability being actively exploited in widespread campaigns. However, given the common nature of SQL injection in WordPress plugins, proof-of-concept (PoC) exploit code is likely available or will be developed shortly. Automated scanning tools will almost certainly incorporate this vulnerability into their checks, increasing the likelihood of opportunistic attacks.

Analyst Recommendation

Given the high severity (CVSS 7.5) and the potential for a complete database compromise by an unauthenticated attacker, it is strongly recommended that organizations take immediate action. All instances of the JS Archive List plugin must be identified and updated to the latest version without delay. While this CVE is not currently on the CISA KEV list, its characteristics make it a prime candidate for future inclusion. A comprehensive audit of all installed WordPress plugins should be conducted to remove any unnecessary components and reduce the overall attack surface.

Executive Summary:
A high-severity vulnerability has been identified in the Restrict File Access plugin for WordPress, which could allow an attacker to perform unauthorized actions. By tricking a logged-in administrator into clicking a malicious link, an attacker could potentially alter file access permissions, leading to the exposure of sensitive files or disruption of website functionality. All organizations using this plugin are urged to take immediate action to mitigate this risk.

Vulnerability Details

CVE-ID: CVE-2025-7667

Affected Software: WordPress Restrict File Access plugin

Affected Versions: All versions up to, and including, version 1

Vulnerability: The vulnerability is a Cross-Site Request Forgery (CSRF). The plugin fails to implement or correctly validate security nonces (unique tokens) for its administrative actions. An attacker can craft a malicious web page or link that, when visited by a logged-in administrator, will force the administrator's browser to send an unauthorized request to the WordPress site. Because the request is sent from the administrator's authenticated browser session, the website processes the request as a legitimate action, allowing the attacker to change the plugin's settings, such as modifying or removing file access restrictions.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 8.1. Successful exploitation could have a significant business impact, including the unauthorized disclosure of sensitive or confidential information if an attacker disables file protection rules. This could lead to data breaches, reputational damage, and potential regulatory penalties. Furthermore, an attacker could maliciously alter access rules to cause a denial of service for legitimate users trying to access necessary files, disrupting business operations that rely on the website's content.

Remediation Plan

Immediate Action: Immediately update the "Restrict File Access" plugin to the latest version, which contains a patch for this vulnerability. After updating, administrators should audit the plugin's configuration to verify that all file access rules are correct and have not been tampered with. If the plugin's functionality is no longer required, it should be deactivated and uninstalled to reduce the overall attack surface of the website.

Proactive Monitoring: Monitor web server access logs for unusual GET or POST requests to the plugin’s administrative endpoints, particularly those with referrers from external or unexpected domains. Review WordPress audit logs for any unauthorized or suspicious changes to the "Restrict File Access" plugin settings. Configure alerts for any unexpected changes to file permissions on the server for files managed by this plugin.

Compensating Controls: If immediate patching is not feasible, implement a Web Application Firewall (WAF) with rules specifically designed to detect and block CSRF attack patterns. Ensure administrators practice good security hygiene by logging out of their WordPress administrative sessions when they are finished, minimizing the time window for a potential attack.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 15, 2025, there are no known public exploits or reports of this vulnerability being actively exploited in the wild. However, CSRF is a well-understood attack vector, and a functional exploit could be developed with minimal effort by threat actors.

Analyst Recommendation

Given the high CVSS score and the potential for sensitive data exposure, we recommend that this vulnerability be remediated with high priority. While this CVE is not currently on the CISA Known Exploited Vulnerabilities (KEV) catalog, its severity warrants immediate attention. All administrators of WordPress sites using the "Restrict File Access" plugin should apply the vendor-supplied patch immediately. If patching must be delayed, the compensating controls outlined above should be implemented as an interim measure.

Executive Summary:
A high-severity privilege escalation vulnerability exists in the Miniorange OTP Verification with Firebase plugin for WordPress. This flaw allows a low-privileged attacker, such as a subscriber, to gain administrative control over an affected website. Successful exploitation could lead to a complete site compromise, data theft, or malware distribution.

Vulnerability Details

CVE-ID: CVE-2025-7665

Affected Software: Miniorange OTP Verification with Firebase plugin for WordPress

Affected Versions: All versions within the 3.x branch prior to the patched version. See vendor advisory for specific affected versions.

Vulnerability: The vulnerability is due to a missing capability check within the handle_mofirebase_form_options function. This function fails to verify if the user executing it has the appropriate administrative permissions. An authenticated, low-privilege attacker can send a specially crafted request to this function to modify plugin settings, escalate their own privileges to an administrator level, and gain full control over the WordPress site.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 8.1. A successful exploit could have a significant business impact, leading to a full compromise of the organization's website. Potential consequences include reputational damage from website defacement, theft of sensitive customer or business data, financial loss, and the use of the compromised server to host phishing pages or malware. The ease of exploitation for an authenticated user elevates the risk to any public-facing WordPress site using the vulnerable plugin.

Remediation Plan

Immediate Action: Immediately update the "Miniorange OTP Verification with Firebase" plugin to the latest patched version provided by the vendor. After updating, review all user accounts, especially those with high privileges, for any unauthorized changes. As a best practice, audit all installed plugins and remove any that are no longer necessary to reduce the overall attack surface.

Proactive Monitoring: Monitor web server access logs for direct POST requests to the administrative functions of the plugin, particularly those involving the handle_mofirebase_form_options action. Investigate any such requests originating from users without administrative privileges. Implement monitoring to detect and alert on unauthorized changes to user roles and permissions within the WordPress database.

Compensating Controls: If immediate patching is not feasible, consider implementing a Web Application Firewall (WAF) rule to block access to the vulnerable function from non-administrative users. Alternatively, temporarily disable the plugin until it can be safely updated to a secure version.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of September 19, 2025, there is no publicly available exploit code, and no active exploitation has been observed in the wild. However, due to the nature of privilege escalation vulnerabilities in popular WordPress plugins, threat actors are likely to develop exploits quickly.

Analyst Recommendation

Given the high CVSS score of 8.1 and the critical impact of a privilege escalation vulnerability, it is strongly recommended that organizations prioritize the immediate patching of this flaw. Although this CVE is not currently listed on the CISA KEV catalog, its severity warrants urgent attention. All instances of the Miniorange OTP Verification with Firebase plugin should be updated without delay to prevent potential website compromise.

Executive Summary:
A high-severity vulnerability exists in the AL Pack plugin for WordPress, identified as CVE-2025-7664. This flaw allows an unauthenticated attacker to gain unauthorized access by exploiting a missing security check in a specific REST API endpoint. Successful exploitation could lead to unauthorized actions within the affected WordPress site, posing a significant risk to site integrity and security.

Vulnerability Details

CVE-ID: CVE-2025-7664

Affected Software: AL Pack plugin for WordPress

Affected Versions: All versions up to, and including, 1.0

Vulnerability: The vulnerability is a Missing Authorization flaw. The check_activate_permission() function, which serves as the permission callback for the /wp-json/presslearn/v1/activate REST API endpoint, fails to properly verify if the user making the request has the required capabilities. An unauthenticated attacker can send a specially crafted request to this endpoint, bypassing security checks and executing the function's associated actions without proper authorization.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 7.5. Exploitation by an unauthenticated attacker could result in unauthorized activation of plugin features, potentially leading to further security compromises, information disclosure, or denial of service. The primary business risks include damage to the organization's reputation, disruption of web services, and the potential for the compromised website to be used in further attacks.

Remediation Plan

Immediate Action: Immediately update the AL Pack plugin to the latest patched version provided by the vendor. If the plugin is no longer required for business operations, it should be deactivated and uninstalled as a best practice to reduce the attack surface.

Proactive Monitoring: Monitor web server and Web Application Firewall (WAF) logs for any requests targeting the /wp-json/presslearn/v1/activate endpoint. Review WordPress audit logs for any unexpected or unauthorized activation events related to the plugin. An increase in requests to this endpoint from unknown IP addresses could indicate scanning or exploitation attempts.

Compensating Controls: If immediate patching is not feasible, implement a WAF rule to block all access to the vulnerable endpoint (/wp-json/presslearn/v1/activate). Alternatively, temporarily disable the AL Pack plugin until it can be safely updated. Restricting public access to the WordPress REST API can also serve as a broad mitigating control.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of August 17, 2025, there are no known public proof-of-concept exploits or active attacks targeting this vulnerability. However, given the simplicity of exploiting missing authorization flaws via REST API endpoints, the likelihood of an exploit being developed is high.

Analyst Recommendation

Due to the high severity rating (CVSS 7.5) and the fact that this vulnerability can be exploited by an unauthenticated attacker, it is strongly recommended that organizations prioritize the immediate application of the vendor-supplied patch. Although this vulnerability is not currently on the CISA KEV list, its accessibility makes it an attractive target for threat actors. Organizations should apply the update and verify that compensating controls are in place if patching cannot be performed immediately.

Executive Summary:
A high-severity vulnerability has been identified in the WebRTC component of Google Chrome and other Google products. This flaw, a "Use After Free" memory corruption issue, could allow a remote attacker to execute arbitrary code on a user's system simply by tricking them into visiting a specially crafted webpage. Successful exploitation could lead to a full system compromise, allowing attackers to steal sensitive data or install malicious software.

Vulnerability Details

CVE-ID: CVE-2025-7657

Affected Software: Google Multiple Products

Affected Versions: Google Chrome versions prior to 138

Vulnerability: This vulnerability is a Use After Free condition within the WebRTC (Web Real-Time Communication) module of Google Chrome. An attacker can exploit this by creating a malicious website that, when visited by a user, makes specific malformed calls to the WebRTC API. This causes the browser to incorrectly manage memory, freeing a pointer to a memory location but attempting to reference it again later. An attacker can manipulate the application's memory heap to place malicious shellcode into that deallocated memory block, leading to its execution when the dangling pointer is used. This results in arbitrary code execution within the security context of the sandboxed browser process, which could potentially be chained with other vulnerabilities to escape the sandbox and achieve full system control.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 8.8, posing a significant risk to the organization. A successful exploit could allow an unauthenticated, remote attacker to execute arbitrary code on an employee's workstation. The potential consequences include the installation of malware such as ransomware or spyware, theft of sensitive corporate data (including credentials, financial records, and intellectual property), and using the compromised system as a pivot point to launch further attacks against the internal network. Given the widespread use of Google Chrome in corporate environments, a single user visiting a malicious link could result in a major security breach.

Remediation Plan

Immediate Action: The primary remediation is to apply vendor-supplied security updates across all managed endpoints immediately. IT administrators must ensure that all instances of Google Chrome are updated to version 138 or later. Following the update, security teams should monitor for any signs of post-patch exploitation attempts and review web proxy and endpoint logs for indicators of compromise related to this vulnerability.

Proactive Monitoring: Security teams should proactively monitor for anomalous activity originating from browser processes. This includes looking for browsers (e.g., chrome.exe) spawning unexpected child processes like cmd.exe or powershell.exe. Monitor DNS and network proxy logs for outbound connections from workstations to suspicious or newly registered domains, which could indicate a command-and-control (C2) channel established after a successful exploit.

Compensating Controls: If immediate patching is not feasible, organizations should consider implementing compensating controls. These may include using application control solutions to prevent browsers from executing unauthorized code or scripts, ensuring Endpoint Detection and Response (EDR) tools are configured to detect and block memory exploitation techniques, and enforcing strict web filtering to block access to uncategorized or known malicious websites. If business-critical applications do not depend on it, temporarily disabling WebRTC via browser policy could also serve as a mitigating factor.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of the publication date of July 15, 2025, there are no known public proof-of-concept exploits or reports of this vulnerability being actively exploited in the wild. The vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. However, vulnerabilities in major web browsers like Chrome are highly attractive targets for threat actors, and it is anticipated that exploit code will be developed.

Analyst Recommendation

Given the high severity (CVSS 8.8) of this vulnerability and its potential for remote code execution, we strongly recommend that organizations treat this as a critical priority. The risk of exploitation is significant due to the ubiquitous nature of the Google Chrome browser. Although there is no evidence of active exploitation at this time, the window of opportunity for attackers is open until systems are patched. Organizations must prioritize the immediate deployment of Google Chrome version 138 or newer to all endpoints to mitigate this threat.

Executive Summary:
A high-severity vulnerability has been identified in the V8 JavaScript engine, which is a core component of Google Chrome and other products. This flaw, an integer overflow, can be exploited by a remote attacker who tricks a user into visiting a specially crafted webpage. Successful exploitation could allow the attacker to execute arbitrary code on the victim's computer, potentially leading to a full system compromise and data theft.

Vulnerability Details

CVE-ID: CVE-2025-7656

Affected Software: Google Multiple Products

Affected Versions: Google Chrome versions prior to 138. See vendor advisory for other affected products.

Vulnerability: The vulnerability is an integer overflow within the V8 JavaScript engine. An attacker can exploit this by creating a malicious website containing specific JavaScript code that triggers a mathematical miscalculation during processing. This overflow leads to a memory corruption condition, which can be leveraged to bypass security protections and achieve arbitrary code execution within the security context of the browser process.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 8.8. Successful exploitation could allow an attacker to compromise employee workstations through drive-by-download attacks, requiring no user interaction beyond visiting a malicious or compromised website. The consequences include the installation of malware such as ransomware or spyware, theft of sensitive corporate data and user credentials, and the potential for an attacker to use the compromised machine to move laterally within the corporate network, posing a significant risk to business operations and data confidentiality.

Remediation Plan

Immediate Action: Apply vendor security updates immediately. All systems running affected versions of Google Chrome or other products utilizing the V8 engine should be patched to version 138 or later using enterprise patch management systems. Concurrently, security teams should monitor for signs of exploitation and review relevant access logs for suspicious activity originating from web browsers.

Proactive Monitoring: Monitor endpoint detection and response (EDR) solutions for alerts related to suspicious process behavior or memory manipulation originating from browser processes (e.g., chrome.exe). Review web proxy and DNS logs for connections to known malicious domains, newly registered domains, or unusual traffic patterns.

Compensating Controls: If immediate patching is not feasible, implement web filtering to block access to malicious and uncategorized websites. Ensure endpoint security solutions (EDR/AV) are fully updated with the latest signatures and behavioral detection rules. Enforce the principle of least privilege for user accounts to limit the potential impact of a successful compromise.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of July 15, 2025, there are no known public exploits for CVE-2025-7656. However, vulnerabilities in widely-used browser engines are prime targets for threat actors, and it is highly likely that a functional exploit will be developed. Organizations should operate under the assumption that this vulnerability will be exploited in the near future.

Analyst Recommendation

Given the high severity (CVSS 8.8) and the ease of exploitation through a malicious website, immediate patching is the highest priority. Although this CVE is not currently listed on the CISA KEV catalog, browser engine vulnerabilities are frequently targeted and often added once exploitation is observed in the wild. We strongly recommend that all organizations prioritize the deployment of the vendor-provided security updates across all affected systems without delay to mitigate the risk of a widespread endpoint compromise.

Executive Summary:
A high-severity vulnerability has been identified in multiple FunnelKit plugins for WordPress, exposing sensitive information. An unauthenticated attacker can exploit a specific shortcode to read data stored in browser cookies, potentially leading to unauthorized access to user accounts and the theft of session information. Organizations using the affected plugins are at significant risk of data breaches and account takeovers.

Vulnerability Details

CVE-ID: CVE-2025-7654

Affected Software: Multiple FunnelKit Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists within the wf_get_cookie shortcode implemented across several FunnelKit plugins. This shortcode is designed to retrieve and display the value of a specified cookie. Due to improper access control, this functionality can be triggered by an unauthenticated user, allowing them to craft requests that expose the contents of any cookie accessible to the web server, including sensitive session cookies, authentication tokens, and other user-specific data. An attacker could exploit this by injecting the shortcode into content that is processed by the server, such as a comment or a forum post, to exfiltrate cookie data from administrators or other users visiting the page.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 8.8. Successful exploitation could lead to significant business consequences, including the compromise of user and administrator accounts. If an attacker successfully steals a privileged session cookie, they could gain full administrative access to the website, enabling them to deface the site, steal customer data, install malware, or disrupt business operations. This poses a direct risk of reputational damage, financial loss, and regulatory penalties associated with a data breach.

Remediation Plan

Immediate Action: Apply the security updates provided by the vendor across all affected FunnelKit plugins immediately. After patching, review web server and application access logs for any signs of exploitation, such as unusual requests containing the wf_get_cookie shortcode.

Proactive Monitoring: Configure security monitoring tools to search for and alert on the string [wf_get_cookie in web server access logs, particularly in POST request bodies and URL parameters. Monitor for unusual administrator session activity, such as logins from unexpected IP addresses or actions taken outside of normal business hours, which could indicate a session hijacking event.

Compensating Controls: If immediate patching is not feasible, implement a Web Application Firewall (WAF) rule to block any requests containing the pattern [wf_get_cookie. As a temporary measure, consider disabling the affected plugins until they can be safely patched. Restricting permissions for untrusted users to post content that is rendered with shortcodes can also reduce the attack surface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of August 19, 2025, there are no known public proof-of-concept exploits or active exploitation campaigns targeting this vulnerability. However, given the simplicity of exploiting shortcode vulnerabilities, it is highly probable that threat actors will develop an exploit quickly.

Analyst Recommendation
Due to the high CVSS score of 8.8 and the direct risk of account takeover, this vulnerability requires immediate attention. We strongly recommend that organizations prioritize the deployment of the vendor-supplied patches to all affected systems. Although this vulnerability is not currently listed on the CISA KEV list, its severity and the potential for straightforward exploitation warrant treating it as a critical threat. In parallel with patching, organizations should implement the recommended monitoring controls to detect any potential compromise.

Executive Summary:
A high-severity vulnerability has been identified in multiple products from The, specifically within the llama-index-core component. This flaw could allow a remote, unauthenticated attacker to execute arbitrary code on an affected system by submitting a specially crafted input. Successful exploitation could lead to a complete system compromise, resulting in data theft, service disruption, and unauthorized access to the network.

Vulnerability Details

CVE-ID: CVE-2025-7647

Affected Software: The Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists within the data processing module of the llama-index-core package. The application fails to properly sanitize user-supplied data when indexing or querying information, leading to a remote code execution (RCE) condition. An attacker can exploit this by crafting a malicious payload (e.g., a document or query) that, when processed by the application, executes arbitrary commands on the underlying server with the privileges of the application's service account.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 7.3. A successful exploit could result in a complete compromise of the server hosting the affected application, leading to significant business consequences. These include the potential for a major data breach involving sensitive information processed by the application, disruption of critical business services, and reputational damage. Furthermore, a compromised system could be used by an attacker as a foothold to launch further attacks against the internal network, escalating the overall security risk to the organization.

Remediation Plan

Immediate Action: Apply vendor security updates immediately to all affected systems. The vendor has released patches to address this vulnerability. Prioritize patching for internet-facing systems and critical servers. After patching, monitor for any signs of exploitation attempts and review historical access and application logs for indicators of compromise.

Proactive Monitoring: Implement enhanced monitoring on affected systems. Security teams should look for unusual child processes being spawned by the application, unexpected outbound network connections from the host server, and review application logs for malformed inputs or error messages that could indicate an exploitation attempt.

Compensating Controls: If patching cannot be immediately deployed, implement compensating controls to reduce risk. This includes placing affected systems behind a Web Application Firewall (WAF) with rules designed to block malicious input patterns, restricting the application's service account permissions to the absolute minimum required, and enforcing strict network segmentation to limit an attacker's ability to move laterally if a compromise occurs.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of September 28, 2025, there are no known public exploits or active exploitation campaigns targeting this vulnerability. However, due to the high severity and the potential for remote code execution, it is highly likely that threat actors are actively researching this flaw and developing exploit code.

Analyst Recommendation
Given the high severity (CVSS 7.3) of this remote code execution vulnerability, we recommend that organizations prioritize the immediate application of the vendor-supplied security patches. Although this vulnerability is not currently listed on the CISA KEV list and there is no known public exploit, the risk of a full system compromise is significant. All remediation and monitoring actions detailed in this report should be implemented without delay to protect against potential exploitation.

Executive Summary:
A high-severity vulnerability exists in the "Extensions For CF7" WordPress plugin, which could allow an attacker to delete critical files from the web server. Successful exploitation could lead to a complete website outage, data loss, or further system compromise. Organizations using this plugin are urged to take immediate action to prevent potential damage to their web assets.

Vulnerability Details

CVE-ID: CVE-2025-7645

Affected Software: WordPress plugin: Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection)

Affected Versions: All versions up to, and including, 3

Vulnerability: The plugin is vulnerable to arbitrary file deletion. This is due to insufficient validation of the file path provided in the 'delete-file' parameter. An authenticated attacker, likely with at least a low-privileged role, can manipulate this parameter using path traversal techniques (e.g., ../../..) to target and delete files outside of the intended directory. This could include critical configuration files (e.g., wp-config.php), core application files, or other sensitive data stored on the file system, leading to a denial of service or other security breaches.

Business Impact

With a CVSS score of 8.1, this vulnerability is rated as High severity. Exploitation could have a significant negative impact on business operations. The deletion of critical WordPress files would likely result in a complete denial of service, making the website inaccessible to users and customers, leading to direct revenue loss and reputational damage. Furthermore, the deletion of data or backup files could result in permanent data loss, incurring significant recovery costs and operational disruption.

Remediation Plan

Immediate Action: Immediately update the "Extensions For CF7" plugin to the latest available version (a version greater than 3). After updating, verify the website's functionality. If the plugin is not essential for business operations, consider deactivating and uninstalling it to reduce the attack surface.

Proactive Monitoring: Monitor web server access logs for POST requests to the plugin's administrative functions that contain the 'delete-file' parameter. Specifically, look for path traversal sequences like ../ or their URL-encoded equivalents (%2e%2e%2f). Implement a File Integrity Monitoring (FIM) solution to generate alerts for any unauthorized changes or deletions to critical WordPress core files and plugin directories.

Compensating Controls: If immediate patching is not feasible, deploy a Web Application Firewall (WAF) with rulesets configured to block path traversal attacks. Additionally, enforce strict file system permissions to ensure the web server's user account cannot delete files outside of its designated directories, particularly critical system and application configuration files.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 23, 2025, there are no known public proof-of-concept exploits or active attacks targeting this vulnerability. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. However, vulnerabilities of this type in popular WordPress plugins are attractive targets for threat actors and are often exploited shortly after public disclosure.

Analyst Recommendation

Given the high severity (CVSS 8.1) of this vulnerability and its potential to cause a complete denial of service, it is strongly recommended that organizations identify all websites using the "Extensions For CF7" plugin and apply the vendor-supplied patch immediately. The risk of website downtime and data loss outweighs the effort required for remediation. Although not currently known to be exploited, proactive patching is the most effective defense against future attacks.

Executive Summary:
A critical authentication bypass vulnerability has been discovered in the Simpler Checkout plugin for WordPress. This flaw allows an unauthenticated attacker to gain unauthorized access to any user account, including administrative accounts, without needing a password. Successful exploitation could lead to a complete compromise of the affected website, resulting in data theft, malicious content injection, and significant reputational damage.

Vulnerability Details

CVE-ID: CVE-2025-7642

Affected Software: The Simpler Checkout plugin for WordPress

Affected Versions: 0.7.0 to 1.1.9

Vulnerability: The vulnerability exists because the plugin fails to properly validate a user's identity during the login process. An unauthenticated remote attacker can craft a specific request to a vulnerable component of the plugin, which bypasses standard authentication checks. This allows the attacker to impersonate any existing user on the WordPress site, including users with administrative privileges, by simply knowing their username.

Business Impact

This vulnerability is rated as critical severity with a CVSS score of 9.8. Exploitation could have a severe and direct impact on the business. An attacker gaining administrative access can lead to a complete takeover of the website, theft of sensitive customer data (including Personally Identifiable Information and payment details), website defacement, installation of malware or backdoors for persistent access, and disruption of e-commerce operations. Such an incident would result in significant financial loss, regulatory fines, and irreparable damage to the organization's reputation and customer trust.

Remediation Plan

Immediate Action: Immediately update the Simpler Checkout plugin for WordPress to the latest patched version (above 1.1.9) on all websites. After patching, review all user accounts, especially administrative ones, for any unauthorized changes or suspicious activity.

Proactive Monitoring: Actively monitor web server access logs and WordPress security logs for unusual login events or direct access attempts to the plugin's files from unknown IP addresses. Look for patterns indicative of an attacker attempting to enumerate usernames or exploit the authentication bypass flaw. Implement security information and event management (SIEM) rules to alert on multiple failed logins followed by a successful login from an unfamiliar source.

Compensating Controls: If immediate patching is not feasible, consider the following controls:

• Implement a Web Application Firewall (WAF) with virtual patching rules designed to block requests exploiting this specific vulnerability.
• Restrict access to the WordPress administrative dashboard (/wp-admin/) to only trusted IP addresses.
• Temporarily disable the Simpler Checkout plugin until it can be safely updated. This should only be done if the plugin is not critical to core business functions.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of August 23, 2025, there are no known public exploits or active exploitation campaigns targeting this vulnerability. However, due to the critical nature of authentication bypass flaws, it is highly probable that proof-of-concept (PoC) exploit code will be developed and released publicly in the near future, increasing the risk of widespread attacks.

Analyst Recommendation
Given the critical CVSS score of 9.8, this vulnerability presents an immediate and severe risk to the organization. Although this CVE is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, its high impact and the potential for easy exploitation demand urgent action. We strongly recommend that all instances of the Simpler Checkout plugin be patched to the latest version immediately. A thorough review for indicators of compromise should be conducted post-remediation to ensure the integrity of the websites has not been breached.

Executive Summary:
A high-severity Cross-Site Request Forgery (CSRF) vulnerability has been identified in the hiWeb Export Posts plugin for WordPress. An attacker could exploit this flaw by tricking a logged-in administrator into clicking a malicious link, forcing their browser to perform unauthorized actions such as exporting sensitive site data or altering plugin settings without their consent. This could lead to a data breach or website misconfiguration.

Vulnerability Details

CVE-ID: CVE-2025-7640

Affected Software: WordPress Multiple Products

Affected Versions: All versions up to, and including, the last unpatched version. (Note: The CVE description lists version '0', which is likely a placeholder).

Vulnerability: The hiWeb Export Posts plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF). The plugin fails to implement or correctly validate anti-CSRF tokens (nonces) for its administrative actions. An attacker can craft a malicious webpage or link that, when visited by a logged-in administrator, sends a forged request to the WordPress site. Because the request is sent from the administrator's authenticated browser session, the vulnerable plugin processes it as a legitimate command, allowing the attacker to execute actions like exporting posts or modifying configurations on behalf of the administrator.

Business Impact

This is a High severity vulnerability with a CVSS score of 8.1. Successful exploitation could have a significant business impact, including the unauthorized exfiltration of sensitive information contained within posts, such as draft business plans, internal communications, or personally identifiable information (PII). This can lead to a data breach, resulting in regulatory fines (e.g., under GDPR or CCPA), reputational damage, and loss of customer trust. Furthermore, an attacker could alter plugin settings to disrupt site functionality or potentially create additional security weaknesses.

Remediation Plan

Immediate Action: Immediately update the "hiWeb Export Posts" plugin to the latest patched version provided by the vendor. If the plugin is not essential for business operations, the recommended course of action is to deactivate and completely remove it from the WordPress installation to eliminate the attack surface.

Proactive Monitoring: Monitor web server and WAF logs for unusual POST requests to the plugin's administrative endpoints, especially those with unexpected or missing referrer headers. Configure security information and event management (SIEM) systems to alert on multiple, rapid requests to the plugin's export function from a single administrative user account, which could indicate a successful CSRF attack.

Compensating Controls: If patching is not immediately possible, implement a Web Application Firewall (WAF) with specific rules to inspect and block malicious requests targeting the vulnerable plugin's functions. Enforcing the SameSite=Strict cookie attribute can provide protection in modern browsers. Additionally, restricting access to the WordPress administrative dashboard (/wp-admin/) to trusted IP addresses can limit the exposure of administrative functions to potential attackers.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 24, 2025, there are no known public proof-of-concept exploits or active exploitation campaigns targeting this vulnerability. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Analyst Recommendation
Given the high severity rating (CVSS 8.1) and the potential for a data breach, organizations must treat this vulnerability with urgency. We strongly recommend that all WordPress sites using the "hiWeb Export Posts" plugin be patched or have the plugin removed immediately. Although there is no evidence of active exploitation, high-severity vulnerabilities in popular platforms like WordPress are prime targets for threat actors. Proactive remediation is the most effective strategy to mitigate risk and prevent future compromise.

---METADATA---
VENDOR: Ergosis Security
PRODUCT: Security Systems Computer Industry and Trade Inc
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Ergosis Security systems are vulnerable to SQL Injection, allowing unauthorized database access through the improper neutralization of special elements in SQL commands.

Executive Summary:
An SQL Injection vulnerability in Ergosis Security Systems products poses a critical risk of unauthorized database access and potential data exfiltration.

Vulnerability Details

CVE-ID: CVE-2025-7636

Affected Software: Ergosis Security Systems Computer Industry and Trade Inc

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is an SQL Injection vulnerability where the application fails to properly neutralize special elements in SQL commands. This allows an attacker to manipulate backend database queries, potentially leading to unauthorized data disclosure or modification.

Business Impact

The CVSS score of 8.8 indicates a high severity level, primarily due to the potential for complete database compromise. Successful exploitation could result in the exfiltration of sensitive security or user data, loss of data integrity, and disruption of security management services provided by the system.

Remediation Plan

Immediate Action: Contact the vendor or monitor their official portal for the release of a security patch and apply it as soon as it becomes available.

Proactive Monitoring: Review database access logs for suspicious query patterns, such as unexpected syntax or large volumes of data being queried by non-administrative accounts.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter and block common SQL injection patterns, providing a layer of protection until a permanent vendor patch is applied.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

SQL injection vulnerabilities are high-risk entry points for attackers. Organizations relying on Ergosis Security systems must treat this as a high-priority item, ensuring all systems are patched immediately upon the release of a security update from the vendor.

Executive Summary:
A critical vulnerability has been identified in multiple products from The WP Travel Engine, specifically affecting the Tour Booking Plugin. This flaw allows an unauthenticated attacker to access and read sensitive files on the web server, which could expose confidential data such as database credentials, leading to a full system compromise. Immediate patching is required to mitigate the significant risk of a data breach and server takeover.

Vulnerability Details

CVE-ID: CVE-2025-7634

Affected Software: The WP Travel Engine Multiple Products

Affected Versions: All versions up to, and including, 6.6.7

Vulnerability: The vulnerability is a Local File Inclusion (LFI) flaw within the WP Travel Engine WordPress plugin. An unauthenticated attacker can exploit this by manipulating the mode parameter in a request sent to the application. By using directory traversal techniques (e.g., ../../), the attacker can trick the application into including and displaying the contents of arbitrary files from the server's local file system, such as /etc/passwd or the wp-config.php file containing database credentials.

Business Impact

This vulnerability is rated as critical severity with a CVSS score of 9.8, posing an immediate and severe threat to the organization. Successful exploitation could lead to the exposure of highly sensitive information, including database connection strings, application source code, API keys, and other system configuration files. This could result in a complete compromise of the web server, a significant data breach, reputational damage, regulatory fines, and financial loss.

Remediation Plan

Immediate Action: Immediately update all instances of The WP Travel Engine plugins to the latest patched version as recommended by the vendor. After patching, review web server access logs for any signs of past exploitation attempts targeting this vulnerability.

Proactive Monitoring: Configure security monitoring to detect and alert on suspicious web requests. Specifically, monitor for GET requests containing directory traversal payloads (e.g., ../, %2e%2e%2f) within the mode parameter. Monitor for unusual file access patterns or outbound network connections originating from the web server process.

Compensating Controls: If immediate patching is not feasible, implement a Web Application Firewall (WAF) with rules designed to block directory traversal attacks. Additionally, enforce strict file permissions on the web server to limit the web server user's access to sensitive system files and directories, reducing the impact of a potential breach.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of October 9, 2025, there are no known public proof-of-concept exploits or active exploitation campaigns targeting this vulnerability. However, due to the simplicity of exploiting LFI vulnerabilities, it is highly likely that exploits will be developed quickly. The vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog.

Analyst Recommendation
Given the critical CVSS score of 9.8 and the potential for a full system compromise, this vulnerability requires immediate attention. The primary recommendation is to apply the vendor-supplied patches to all affected systems without delay. Organizations should treat this as a top priority for their patch management cycle. While not yet listed in the CISA KEV catalog, the high severity and potential for widespread impact make proactive remediation essential to prevent future exploitation.

Executive Summary:
A critical vulnerability has been identified in certain versions of Sophos Firewall. This flaw, an SQL injection in the legacy email proxy, can be exploited by a remote, unauthenticated attacker by sending a malicious email, potentially allowing them to gain full control of the firewall appliance and compromise the entire network's security.

Vulnerability Details

CVE-ID: CVE-2025-7624

Affected Software: Sophos Firewall

Affected Versions: Versions older than 21.0 MR2 (21.0.2)

Vulnerability: The vulnerability is a pre-authentication SQL injection flaw within the legacy (transparent) SMTP proxy component of the Sophos Firewall. An attacker can exploit this by sending a specially crafted email to the firewall. If a policy is active that quarantines emails, the firewall processes the malicious email, allowing the embedded SQL commands to be executed on the underlying database, which can be escalated to achieve remote code execution (RCE) on the firewall operating system.

Business Impact

This vulnerability is rated as critical severity with a CVSS score of 9.8. Successful exploitation could lead to a complete compromise of the network perimeter security device. An attacker with RCE on the firewall could bypass all security policies, monitor, intercept, or reroute all network traffic, gain a foothold to attack internal network resources, exfiltrate sensitive data, or deploy ransomware. The business impact includes potential for significant data breaches, operational disruption, and loss of trust, representing a severe risk to the organization's security posture.

Remediation Plan

Immediate Action: Immediately upgrade all affected Sophos Firewall instances to version 21.0 MR2 (21.0.2) or a later version as recommended by the vendor. After patching, review firewall system and access logs for any signs of compromise that may have occurred prior to the update.

Proactive Monitoring: Security teams should actively monitor for exploitation attempts. This includes scrutinizing SMTP traffic logs for unusual patterns or malformed requests, specifically those related to the email quarantine feature. Implement SIEM rules to detect and alert on suspicious SQL syntax or error messages originating from the firewall's SMTP proxy. Monitor the firewall for any unexpected outbound connections or unauthorized processes.

Compensating Controls: If patching cannot be performed immediately, organizations should disable the legacy (transparent) SMTP proxy feature if it is not critical for business operations. If the feature must remain active, consider placing an upstream email security gateway or a Web Application Firewall (WAF) with SMTP inspection capabilities to filter for SQL injection attacks before they reach the vulnerable firewall.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Jul 21, 2025, there are no known public proof-of-concept exploits or active exploitation campaigns targeting this vulnerability. However, given the critical severity (CVSS 9.8) and the potential for remote code execution on a widely deployed security appliance, it is highly probable that threat actors will develop exploits in the near future. This vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities (KEV) catalog.

Analyst Recommendation

Due to the critical nature of this vulnerability, we strongly recommend that organizations prioritize the immediate patching of all affected Sophos Firewall appliances. The risk of a full network compromise from an unauthenticated, remote attacker is exceptionally high. This vulnerability should be addressed with the utmost urgency, following the principle of treating critical edge-device vulnerabilities as an active threat, regardless of their current KEV status.

Executive Summary:
A critical Remote Code Execution (RCE) vulnerability, identified as CVE-2025-7620, has been discovered in a cross-browser document creation component used in multiple products from The (Digitware System Integration Corporation). This high-severity flaw can be exploited by an unauthenticated remote attacker to gain complete control over an affected system. Successful exploitation could lead to significant data breaches, system compromise, and widespread service disruption.

Vulnerability Details

CVE-ID: CVE-2025-7620

Affected Software: The Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists within the cross-browser document creation component developed by Digitware System Integration Corporation. An attacker can exploit this flaw by sending a specially crafted document or data stream to the vulnerable component. When the application processes this malicious input, it triggers an error that allows the attacker's arbitrary code to be executed on the server with the permissions of the running application, leading to a full system compromise. The attack can be launched over the network and does not require authentication or user interaction.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 8.8, posing a significant risk to the organization. A successful exploit grants an attacker full control over the affected server, directly impacting confidentiality, integrity, and availability. Potential consequences include theft of sensitive corporate or customer data, installation of ransomware, destruction of critical information, and using the compromised system as a pivot point to attack other internal network resources. The business could face severe financial loss, regulatory fines, reputational damage, and loss of customer trust.

Remediation Plan

Immediate Action: Per vendor guidance, organizations must apply the released security patches immediately, prioritizing all internet-facing systems. After patching, it is crucial to review system and application access logs for any signs of compromise that may have occurred prior to remediation.

Proactive Monitoring: Security teams should actively monitor for any signs of exploitation. This includes looking for unusual processes spawned by the application's service account, unexpected outbound network connections from affected servers, and anomalies or error messages in application logs related to document processing. Intrusion Detection Systems (IDS) and Web Application Firewalls (WAF) should be updated with signatures to detect and block attempts to exploit this vulnerability.

Compensating Controls: If immediate patching is not feasible, implement the following controls to reduce risk:

• Restrict network access to the vulnerable application component to only trusted IP ranges.
• Deploy a Web Application Firewall (WAF) with virtual patching rules to inspect and block malicious payloads targeting the document creation function.
• Ensure the application is running under a service account with the least possible privileges to limit the impact of a potential compromise.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of the publication date, July 14, 2025, there is no known public proof-of-concept exploit code available, and this vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. However, due to the high CVSS score and the RCE impact, it is highly probable that threat actors will rapidly develop and deploy exploits. Organizations should assume active scanning for vulnerable systems has already begun.

Analyst Recommendation
This vulnerability represents a critical threat to the organization and must be addressed with the highest priority. The potential for unauthenticated remote code execution on internet-facing systems necessitates immediate action. We strongly recommend adhering to the remediation plan by applying vendor patches to all affected systems without delay, starting with external-facing assets. If patching is delayed for any reason, compensating controls must be implemented immediately to mitigate the significant risk of compromise.

Executive Summary:
A high-severity vulnerability, identified as CVE-2025-7619, exists within the BatchSignCS Windows application. This flaw allows an attacker to write arbitrary files to any location on the host system, which could be leveraged to overwrite critical system files, install malware, and ultimately lead to a full system compromise. Organizations using this software are at significant risk of unauthorized access and loss of system integrity.

Vulnerability Details

CVE-ID: CVE-2025-7619

Affected Software: BatchSignCS by WellChoose (may be bundled in other products)

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The BatchSignCS application contains an Arbitrary File Write vulnerability. An attacker with the ability to interact with the application, potentially as a low-privileged user, can craft a malicious request that bypasses security checks. This allows the attacker to specify an arbitrary path and filename on the system, causing the application to write a file with attacker-controlled content to that location. This could be used to plant a malicious executable in a startup folder for persistence, overwrite a legitimate system DLL to achieve privilege escalation, or corrupt critical operating system files to cause a denial of service.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 8.8. Successful exploitation could lead to a complete compromise of the affected Windows system. The primary business impacts include the potential for data theft of sensitive corporate or customer information, deployment of ransomware leading to significant financial loss and operational downtime, and a loss of system integrity. A compromised system could also be used as a pivot point for further attacks across the internal network, escalating the incident's scope and impact.

Remediation Plan

Immediate Action:
Identify all systems running the affected BatchSignCS software and apply the security updates provided by the vendor (WellChoose) immediately. Prioritize patching on critical assets, such as servers and systems handling sensitive data. After patching, verify that the update was successfully applied.

Proactive Monitoring:
Review application and Windows event logs for any unusual file write operations, especially to sensitive directories like C:\Windows\System32, C:\Program Files, or user startup folders. Implement File Integrity Monitoring (FIM) to generate alerts on unauthorized changes to critical system files. Monitor for the creation of new, unrecognized services or scheduled tasks that could indicate a persistence mechanism has been established.

Compensating Controls:
If patching cannot be immediately deployed, consider the following controls:

• Temporarily disable or uninstall the BatchSignCS application if it is not essential for business operations.
• Use application control solutions (e.g., AppLocker) to prevent the execution of unauthorized files from common writeable locations.
• Ensure the service or user account running BatchSignCS operates with the principle of least privilege and is restricted from writing to system-critical directories.

Exploitation Status

Public Exploit Available: False

Analyst Notes:
As of July 14, 2025, there are no known public exploits available for this vulnerability. However, given the high CVSS score and the straightforward nature of Arbitrary File Write vulnerabilities, it is highly likely that a functional proof-of-concept (PoC) exploit will be developed and released publicly. This vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, but organizations should operate under the assumption that it will be targeted by threat actors.

Analyst Recommendation

This is a high-severity vulnerability that poses a significant and immediate risk to the organization. The potential for a full system compromise requires an urgent response. We recommend that all system administrators immediately identify assets running the WellChoose BatchSignCS application and apply the vendor-supplied patch without delay. Although not yet listed on the CISA KEV, the severity of this flaw warrants treating it with the highest priority to prevent potential exploitation leading to data breaches or ransomware events.

Executive Summary:
A high-severity vulnerability has been identified in Management's software products, specifically impacting the PHPGurukul Hospital Management System. Successful exploitation could allow an unauthenticated attacker to compromise the system, potentially leading to unauthorized access to sensitive patient data, data modification, and disruption of critical hospital operations.

Vulnerability Details

CVE-ID: CVE-2025-7604

Affected Software: Management Multiple Products

Affected Versions: The vulnerability is confirmed in PHPGurukul Hospital Management System version 4. See the vendor advisory for a complete list of all affected products and versions.

Vulnerability: The vulnerability is a critical flaw, likely an unauthenticated SQL Injection or similar injection attack. An unauthenticated remote attacker could send a specially crafted request to the application. By exploiting this flaw, the attacker could bypass security controls to execute arbitrary database queries, enabling them to read, modify, or delete sensitive information, including protected health information (PHI) and patient records.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 7.3. Exploitation could have severe business consequences, particularly given the context of a hospital management system. A successful attack could lead to the unauthorized disclosure of protected health information (PHI) and personally identifiable information (PII), resulting in significant regulatory fines (e.g., under HIPAA), legal liability, and severe reputational damage. Furthermore, disruption of the hospital management system could impede critical patient care operations, posing a direct risk to patient safety and organizational efficiency.

Remediation Plan

Immediate Action: Organizations must apply the security patches provided by the vendor across all affected systems without delay. After patching, it is crucial to verify that the updates have been successfully installed. Concurrently, security teams should begin actively monitoring for signs of exploitation and thoroughly review historical access logs for any suspicious activity preceding the patch deployment.

Proactive Monitoring: Security teams should configure monitoring and alerting for unusual activity related to the affected application. This includes looking for abnormal SQL queries in database logs, unexpected or malformed requests in web server access logs, and attempts to access or exfiltrate large volumes of data. Network traffic should be monitored for connections from untrusted IP addresses.

Compensating Controls: If immediate patching is not feasible, organizations should implement compensating controls. This includes placing the affected system behind a Web Application Firewall (WAF) with rules specifically configured to block SQL Injection attacks. Restricting network access to the application, allowing connections only from trusted internal IP addresses, can also significantly reduce the attack surface.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of July 14, 2025, there are no known public proof-of-concept exploits or active "in-the-wild" exploitation campaigns targeting this vulnerability. However, given the high severity and the sensitive nature of the data managed by the affected software, threat actors are likely to develop exploit code rapidly. Organizations should treat this vulnerability as an active threat.

Analyst Recommendation

Due to the High severity (CVSS 7.3) of this vulnerability and its potential impact on critical hospital operations and sensitive patient data, we strongly recommend immediate remediation. Although CVE-2025-7604 is not currently listed on CISA's Known Exploited Vulnerabilities (KEV) catalog, the risk of future exploitation is significant. All organizations using the affected PHPGurukul Hospital Management System must prioritize the immediate application of vendor-supplied security updates or implement compensating controls to mitigate this critical risk.

Executive Summary:
A critical vulnerability has been discovered in multiple products from Vendor A, affecting network routing and connectivity devices. This flaw allows an unauthenticated attacker to remotely compromise the affected devices, potentially leading to a complete system takeover. Successful exploitation could result in significant data breaches, network-wide disruptions, and unauthorized access to sensitive internal systems.

Vulnerability Details

CVE-ID: CVE-2025-7574

Affected Software: A Multiple Products

Affected Versions: LB-LINK BL-AC1900, BL-AC2100_AZ3, BL-AC3600, BL-AX1800, BL-AX5400P and BL-WR9000, all versions up to 20250702.

Vulnerability: This critical vulnerability exists within the reboot/restore function of the device's management interface. An unauthenticated remote attacker can send a specially crafted request to this function to execute arbitrary code on the underlying operating system. The attack does not require any prior authentication or user interaction, making it highly exploitable over the network. A successful exploit grants the attacker full administrative control over the device.

Business Impact

This vulnerability is rated as critical with a CVSS score of 9.8, indicating a high risk of compromise with low attack complexity. Exploitation could lead to severe consequences, including the complete takeover of network infrastructure devices. An attacker could intercept, redirect, or modify network traffic, leading to sensitive data exfiltration. Furthermore, compromised devices could be used to launch further attacks against the internal network, disrupt business operations through a denial-of-service, or be co-opted into a botnet for larger-scale malicious activities.

Remediation Plan

Immediate Action: The primary remediation is to apply the security patches provided by the vendor. System administrators must immediately identify all affected devices and update them to the latest firmware version. Refer to the official vendor security advisory for specific patch information and installation instructions.

Proactive Monitoring: Actively monitor for signs of compromise. Review web access logs for unusual or malformed requests targeting the /reboot or /restore endpoints on the device's management interface. Monitor for unexpected device reboots, unauthorized configuration changes, and anomalous outbound traffic from the affected devices to unknown destinations.

Compensating Controls: If patching cannot be performed immediately, implement compensating controls to reduce the risk. Restrict all access to the device's web management interface to a secure, isolated administrative network. If remote management is necessary, ensure it is protected by a VPN and multi-factor authentication. Consider deploying a Web Application Firewall (WAF) with rules to inspect and block malicious requests to the vulnerable functions.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Jul 14, 2025, there are no known public exploits or active exploitation campaigns targeting this vulnerability. However, due to the critical severity (CVSS 9.8) and low attack complexity, it is highly probable that a functional exploit will be developed and released by threat actors in the near future. This vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog.

Analyst Recommendation

Given the critical severity of this vulnerability, immediate action is required. We strongly recommend that all affected products are patched within the next 72 hours. These devices are often perimeter-facing and represent a critical entry point into the network. Even though this CVE is not yet on the CISA KEV list, it should be treated with the highest priority due to the severe potential impact of a successful exploit. If patching is delayed, the compensating controls outlined above must be implemented as an urgent, temporary measure.

Executive Summary:
A high-severity vulnerability has been identified in multiple products from the vendor 'was', which could allow an unauthenticated attacker to take complete control of affected systems over the network. Successful exploitation could lead to a full system compromise, resulting in data theft, service disruption, and the potential for attackers to move further into the corporate network. Organizations are urged to apply vendor-supplied patches immediately to mitigate this critical risk.

Vulnerability Details

CVE-ID: CVE-2025-7550

Affected Software: was Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability is an unauthenticated remote command injection flaw in a core service component present across multiple 'was' products. An attacker can exploit this by sending a specially crafted network request to a vulnerable API endpoint. Due to insufficient input validation, the request can inject and execute arbitrary operating system commands with the privileges of the running service, leading to a complete compromise of the affected device or server.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 8.8. Exploitation of this flaw poses a significant risk to the organization, potentially leading to the complete loss of confidentiality, integrity, and availability of the affected systems. Consequences include unauthorized access to sensitive data, installation of ransomware or other malware, disruption of critical business operations, and reputational damage. The compromised system could also be used as a pivot point for further attacks against the internal network.

Remediation Plan

Immediate Action: The primary remediation is to apply the security updates provided by the vendor immediately across all affected assets. Prioritize patching for systems that are exposed to the internet. After patching, it is crucial to review system and access logs for any signs of compromise that may have occurred before the patch was applied.

Proactive Monitoring: Security teams should actively monitor for signs of exploitation. This includes inspecting network traffic for unusual requests to the affected services, particularly those containing shell metacharacters (e.g., |, ;, &&). Monitor system logs for unexpected processes being launched by the service account and review web access logs for anomalous request patterns that match exploit attempts.

Compensating Controls: If immediate patching is not feasible, implement compensating controls to reduce the risk. Restrict network access to the vulnerable service to only trusted hosts and networks. If applicable, deploy a Web Application Firewall (WAF) or Intrusion Prevention System (IPS) with virtual patching rules designed to block exploit attempts against this specific CVE.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 13, 2025, there are no known public proof-of-concept exploits or active exploitation campaigns targeting this vulnerability. However, given the high CVSS score and the relative simplicity of command injection flaws, it is highly probable that a functional exploit will be developed and published by security researchers or threat actors in the near future. The vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog.

Analyst Recommendation

Due to the high severity (CVSS 8.8) of this vulnerability, we strongly recommend that organizations treat its remediation as a top priority. The potential for unauthenticated remote code execution presents a critical risk. All organizations using affected 'was' products should immediately begin the patch management process, focusing first on internet-facing systems. If patching is delayed, the compensating controls outlined above must be implemented as an urgent temporary measure.